Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

github.com

Post reply on HN
Print view View original

341–350 of 376 posts

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#341

Post by coldcode »

yllus wrote: post #36

For those wondering why the Facebook SDK is so widely used in popular mobile apps: Facebook Login is actually in the minority of reasons to add the Facebook SDK to your mobile app. The vast majority of apps will add the Facebook SDK because it contains Facebook App Ads; a library that "completes the circle" in terms of finding out how effectively the ads you ran on Facebook were at getting people to download, install…

Thankfully we removed FB several years ago when I found it sending data to FB servers that we did not authorize, we support our own logins for our own customers and there was no reason to use it (not sure the history before I got here). Sadly we do use Google Maps and got bit for weeks when that fiasco happened recently. I wish we could just use Apple Maps for iOS but somehow we have some marketing deal or something with Google.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#342

Post by K0nserv »

bryansum wrote: post #138
lucasar wrote: post #26

Earlier quoted context omitted.

I am an iOS developer and most likely the problem is related to configuration and basic analytics, not "siphoning" app data. Offending code : if (restrictiveParams[eventName][@"is_deprecated_event"]) { [deprecatedEventSet addObject:eventName]; } So, the iOS library does not check for nil, and whatever the server is returning does not have the expected content. Lame.

Looks like that would've probably been caught if it were written in Swift.

    if (restrictiveParams[eventName] as! [String: Any])["test"] != nil
In Swift, now hopefully you wouldn't write this code but it's not entirely unlikely too. In fact the above Objective-C snippet is one of the few cases where Objective-C's forgiving `nil` behaviour doesn't save you from a crash.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#343

Post by microcolonel »

0x0 wrote: post #284
fooey wrote: post #39

Seems to be some suggestions now that apps were continuing to crash even after commenting out the FB implementation because FB is managing to do remote API calls just because the framework is linked. https://github.com/facebook/facebook-ios-sdk/issues/1373#iss... > It does not matter. Their libraries are dynamic, and they abuse +load functions for classes with some business logic calls. So, +load will be called anywa…

I'm shocked but perhaps not surprised at many of the comments in that thread. These people are app developers who voluntarily link in huge multimegabyte binary-only third party sdks, and then act surprised that the code they are linking is prone to crashing? It should be obvious that any bug in such an SDK might bring down any app, even on launch and even if your own code never makes an explicit call to the SDK. Thir…

Turns out if you're linking in code (or even calling out to it, but that's another level of effort) you should probably have the source, or have a person on your team who can do basic RE.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#344

Post by microcolonel »

marcus_holmes wrote: post #316
0x0 wrote: post #284

Earlier quoted context omitted.

I'm shocked but perhaps not surprised at many of the comments in that thread. These people are app developers who voluntarily link in huge multimegabyte binary-only third party sdks, and then act surprised that the code they are linking is prone to crashing? It should be obvious that any bug in such an SDK might bring down any app, even on launch and even if your own code never makes an explicit call to the SDK. Thir…

Every time we include a dependency in an application, we give its maintainers commit privileges to production. Who do we trust?

That's only if you don't review the changes, and trace the entry points at least.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#345

Post by cpv »

sbmthakur wrote: post #233
yllus wrote: post #36

For those wondering why the Facebook SDK is so widely used in popular mobile apps: Facebook Login is actually in the minority of reasons to add the Facebook SDK to your mobile app. The vast majority of apps will add the Facebook SDK because it contains Facebook App Ads; a library that "completes the circle" in terms of finding out how effectively the ads you ran on Facebook were at getting people to download, install…

Many apps on my Android device routinely send requests to edge-star- .facebook.com even when I don't use facebook login. Are these ad related requests?

You can get NetGuard on Android and see how often and what is called (facebook.com, graph.facebook.com, other vendors, platforms, IPs, etc). You can choose to block what is not needed. Kind of uBlockOrigin for Android. Sometimes stuff breaks.

And a lot of stuff is not related to FB Login.

Facebook launched Facebook Off Activity a while ago https://news.ycombinator.com/item?id=22178917

You can go to your profile, and check which third parties, or advertisers uploaded contact data of you, download backup data to see in json files which apps what sent about you ("App activated", "Made some purchase").

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#346

Post by ric2b »

marcus_holmes wrote: post #319
yumraj wrote: post #207

Earlier quoted context omitted.

> You always have the choice to not install the app (if you don't want to). Before this article came out was this information available to the users to help them in making this decision. No, it was not! Hence the problem.

I think it's pretty clear that if you're not paying for the application, then you're the product not the customer. Even the most ignorant users have probably got that message by now. If the app is paid-for, it's less forgivable to be using this kind of spyware.

Your flawed logic applies whether it's paid or not: just don't install it.

Apparently you don't think actually knowing if the app includes the SDK is relevant, this is victim blaming of the highest tier.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#347

Post by Nextgrid »

marcus_holmes wrote: post #319
yumraj wrote: post #207

Earlier quoted context omitted.

> You always have the choice to not install the app (if you don't want to). Before this article came out was this information available to the users to help them in making this decision. No, it was not! Hence the problem.

I think it's pretty clear that if you're not paying for the application, then you're the product not the customer. Even the most ignorant users have probably got that message by now. If the app is paid-for, it's less forgivable to be using this kind of spyware.

Spotify is a paid app that includes it.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#348

Post by ric2b »

bzb3 wrote: post #75
Nicksil wrote: post #52

Earlier quoted context omitted.

>Is that "spyware"? Yes, absolutely. It uses energy and bandwidth I paid for to surreptitiously transmit my information for use which will solely benefit Facebook and the software developer.

If the software developer didn't get anything off you they wouldn't make the software available to you in the first place.

And yet FOSS exists.

And paid software (such as Spotify) still does shady stuff like reporting to Facebook that I'm a user of their app and the schedule on which I use it.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#349

Post by s_dev »

jeffbee wrote: post #171
whatthesmack wrote: post #166

We have a few thousand apps on the App Store and got bit by this today. The SDK is very useful for a smooth login experience if the user has the Facebook app installed, because your app can offer Facebook as a login option, then just pop the user over to the Facebook app, they can tap “okay” (or whatever), and jump back to your app. That said, we’re going to rip this thing out of our apps ASAP. No framework should be…

How can one developer have thousands of apps? It sounds just like a giant scattergun for malware. There are not 1000 distinct useful ways to use an iPhone.

>There are not 1000 distinct useful ways to use an iPhone.

This comment reflects badly on your imagination. There are 00s of uses for a concrete brick -- let alone a single device with a plethora of distinct functions.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#350

Post by govg »

Nextgrid wrote: post #249
lancefisher wrote: post #200

We found a couple workarounds while Facebook was busy fixing this. 1. Airplane mode 2. Block facebook.com as adult content under Settings | Screen Time | Content Restrictions | Web Content | Limit Adult Websites | Add a site. 3. Block facebook.com at your router. Option 2 could be helpful if you want to block it for privacy reasons.

Does the adult filter work in apps? If so this seems like a lovely workaround for the lack of firewall.

The adult filter probably works like a DNS bkackhole and simply bans those websites from getting resolved.
Post reply on HN