Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

github.com

Post reply on HN
Print view View original

281–290 of 376 posts

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#281

Post by dang »

smacktoward wrote: post #189
marmada wrote: post #165

Earlier quoted context omitted.

I feel like I'm in the minority here -- but I don't understand the problem. Software developers want to know whether their existing marketing methods are effective. The FB SDK helps with this. You always have the choice to not install the app (if you don't want to). This also helps developers make sure their marketing is effective and reaching the right people, which seems like a win-win to me.

“It is difficult to get a man to understand something, when his salary depends upon his not understanding it.” - Upton Sinclair ( https://en.wikipedia.org/wiki/Upton_Sinclair )

It's probably time to retire Upton to the Internet Hall of Fame next to Betteridge.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#282

Post by ergl »

busymom0 wrote: post #267
drawkbox wrote: post #261

Earlier quoted context omitted.

The Facebook SDK is a single point of failure it seems. If you must integrate Facebook, it is better to use OAuth + API and then control every call, only necessary ones needed i.e. login, friends, maybe game leaderboards, profile photo, etc. Not sure why people are still putting the Facebook SDK in their apps, it is basically malware and tracking for authoritarian ends [1][2]. Engineers are supposed to be anti-author…

> Engineers are supposed to be anti-authoritarians Strongly disagree on this. Exact opposite maybe but I don't want to generalize. Modern authoritarian tactics are pretty much impossible without engineering.

Wait, are you saying that (software) engineers should _actually_ be authoritarian? And you suggest this is because otherwise "authoritarian tactics" wouldn't work?

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#283

Post by zerocrates »

rohansuri wrote: post #276
saagarjha wrote: post #54

Earlier quoted context omitted.

(For the iOS engineers reading along: please don't put network calls in +load, or __attribute__((constructor)), or a C++ static variable, or whatever other clever way you think you can get code execution before main.)

(non C++ developer here) What is the +load being referred?

It's Objective-C being referred to here: the "+" prefix indicates a class method.

Any class can implement +load and the runtime will call the method upon loading the class (note, this doesn't require using it at all).

https://developer.apple.com/documentation/objectivec/nsobjec...

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#284

Post by 0x0 »

fooey wrote: post #39

Seems to be some suggestions now that apps were continuing to crash even after commenting out the FB implementation because FB is managing to do remote API calls just because the framework is linked. https://github.com/facebook/facebook-ios-sdk/issues/1373#iss... > It does not matter. Their libraries are dynamic, and they abuse +load functions for classes with some business logic calls. So, +load will be called anywa…

I'm shocked but perhaps not surprised at many of the comments in that thread. These people are app developers who voluntarily link in huge multimegabyte binary-only third party sdks, and then act surprised that the code they are linking is prone to crashing? It should be obvious that any bug in such an SDK might bring down any app, even on launch and even if your own code never makes an explicit call to the SDK.

Third party SDKs have free reign in your apps. They can launch background threads, intercept and log any and all UI interaction and UI widget/input field values, and call home. All of this without you ever calling a single method explicitly.

It gives the SDK developers a foothold inside each app's sandbox/keychain/developer-specific app ID. It must be a gold mine for correlating and tracking users across apps and websites, breaking down the intended barrier between different apple developer team IDs and app containers.

Last time I checked one of these binary SDKs along the likes of FB, Gmaps, etc just running strings on the binary framework lib was enough to send chills down any developer's spine.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#285

Post by busymom0 »

ergl wrote: post #282
busymom0 wrote: post #267

Earlier quoted context omitted.

> Engineers are supposed to be anti-authoritarians Strongly disagree on this. Exact opposite maybe but I don't want to generalize. Modern authoritarian tactics are pretty much impossible without engineering.

Wait, are you saying that (software) engineers should _actually_ be authoritarian? And you suggest this is because otherwise "authoritarian tactics" wouldn't work?

No, I did not say that. I am not even talking about what they should or shouldn't be. There's no set rule which says engineers are supposed to be pro-authoritarians or anti-authoritarians.

I was disagreeing with what the parent said: "Engineers are supposed to be anti-authoritarians."

I take that to mean that the person thinks engineers are anti-authoritarians - which is simply false and not what happens in real life. Engineers are often enablers of authoritarians.

And this is a bad thing but just fact of life. Humans are flawed and greedy for power. There are higher chances of someone with power to abuse it (engineer in this example but could apply to others too).

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#286

Post by Jare »

marmada wrote: post #165
Nicksil wrote: post #52

Earlier quoted context omitted.

>Is that "spyware"? Yes, absolutely. It uses energy and bandwidth I paid for to surreptitiously transmit my information for use which will solely benefit Facebook and the software developer.

I feel like I'm in the minority here -- but I don't understand the problem. Software developers want to know whether their existing marketing methods are effective. The FB SDK helps with this. You always have the choice to not install the app (if you don't want to). This also helps developers make sure their marketing is effective and reaching the right people, which seems like a win-win to me.

> You always have the choice to not install the app

You also have the choice to consider the practice questionable, unethical, a systemic problem once it becomes widespread; to highlight it in public posts and forums, to protest how widespread it has become, to believe that it should be illegal in the context of consumer and privacy protections, to lobby for making it illegal, etc.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#287

Post by gtufano »

bitcrazy wrote: post #143
fooey wrote: post #39

Seems to be some suggestions now that apps were continuing to crash even after commenting out the FB implementation because FB is managing to do remote API calls just because the framework is linked. https://github.com/facebook/facebook-ios-sdk/issues/1373#iss... > It does not matter. Their libraries are dynamic, and they abuse +load functions for classes with some business logic calls. So, +load will be called anywa…

The Facebook SDK does make some calls on init. https://developers.facebook.com/docs/app-events/gdpr-complia... From them: "The Facebook SDK automatically initializes when the app is opened. When the SDK is initializing, it fetches app settings from Facebook. If you want to block all network requests to Facebook, you can disable automatic initialization." If you want to turn it off, you're supposed to set in your app'…

I would be shocked...

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#288

Post by monort »

cycomanic wrote: post #210
opportune wrote: post #136

Earlier quoted context omitted.

Devil's advocate: you could always not run those apps. Although for non-technical users it would be challenging to determine if the apps were transmitting that info, it's possible for technical users to detect it (assuming the info goes to an obviously-facebook url and isn't piped through e.g. spotify) Additionally I don't think there is anything wrong with client-side analytics in general since it's basically the on…

> Additionally I don't think there is anything wrong with client-side analytics in general since it's basically the only way to monitor performance/usage in production. And this type of thing is hard to discern from the more benign case I think in these situations it often helps if we would find this behaviour acceptable in the real world. For example we see advertisment in airport toilets or malls or whatever. As so…

Offline shops already track you via bluetooth and wifi

https://falkvinge.net/2017/04/15/schiphol-airport-tracking-e...

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#289

Post by cpv »

Maybe this will motivate product owners, developers, marketers, to start thinking before implementing a dozen of SDKs in a mobile app (or website). It's understandable when you need some analytics/crash reporting, but it becomes a privacy and ethics question when a lot of data is wandering around, and even better, crashes your app. And the users will blame you, they don't even know how many SDKs are there and what they are doing.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#290

Post by ratww »

lucasar wrote: post #99
surferbayarea wrote: post #28

Earlier quoted context omitted.

Well the reason FB/Foursquare/Google etc add these to 3rd party apps is so they can get data. Example if you visit a website which has a Facebook like button, your browser fetches the js files/which maybe even makes an API call to let FB know your IP (and hence location). All this data is fed to the giant system that feeds you ads. Adding their SDK to other apps/sites (even if there is no user facing need) is a commo…

You have no idea what you're talking about. Apps use the Facebook library because a good portion of end-users want to be able to login with a Facebook button --or Google, or whatever that doesn't require them to create a user/password account. It's just that simple.

If you only need login, then you can have the same functionality without the Facebook SDK or Google SDK by using OAuth.
Post reply on HN