Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

Post by oblio » Thu, May 07, 2020, 11:21 AM UTC

ChrisMarshallNY wrote: post #323

0x0 wrote: post #284

Earlier quoted context omitted.

I'm shocked but perhaps not surprised at many of the comments in that thread. These people are app developers who voluntarily link in huge multimegabyte binary-only third party sdks, and then act surprised that the code they are linking is prone to crashing? It should be obvious that any bug in such an SDK might bring down any app, even on launch and even if your own code never makes an explicit call to the SDK. Thir…

We are now in a “dependency-oriented programming environment” (D.O.P.E) world. One the one hand, it’s easy to sniff at the use of dependencies, when we have these kinds of disasters, but on the other hand, dependencies give us the ability to do truly great stuff. For example, I program Apple devices (not just iOS). I wrote my first Apple code in 1986, so I have some “prior art.” I’ve “seen it all.” I remember the day…

Post by agustif » Thu, May 07, 2020, 11:27 AM UTC

DagAgren wrote: post #314

mhensley wrote: post #167

Earlier quoted context omitted.

Would 100% suggest going the basic OAuth route with FB, and not relying on their SDKs whenever possible. Been bit by Friday-afternoon-PST deployments that wreak havoc until work starts Monday too many times :/

Did anyone make any replacement login-only libraries for Facebook?

Post by sneak » Thu, May 07, 2020, 11:33 AM UTC

marmada wrote: post #165

Nicksil wrote: post #52

Earlier quoted context omitted.

>Is that "spyware"? Yes, absolutely. It uses energy and bandwidth I paid for to surreptitiously transmit my information for use which will solely benefit Facebook and the software developer.

I feel like I'm in the minority here -- but I don't understand the problem. Software developers want to know whether their existing marketing methods are effective. The FB SDK helps with this. You always have the choice to not install the app (if you don't want to). This also helps developers make sure their marketing is effective and reaching the right people, which seems like a win-win to me.

Post by sneak » Thu, May 07, 2020, 11:36 AM UTC

yllus wrote: post #36

For those wondering why the Facebook SDK is so widely used in popular mobile apps: Facebook Login is actually in the minority of reasons to add the Facebook SDK to your mobile app. The vast majority of apps will add the Facebook SDK because it contains Facebook App Ads; a library that "completes the circle" in terms of finding out how effectively the ads you ran on Facebook were at getting people to download, install…

Post by superrad » Thu, May 07, 2020, 11:49 AM UTC

mschuster91 wrote: post #297

bitcrazy wrote: post #143

Earlier quoted context omitted.

The Facebook SDK does make some calls on init. https://developers.facebook.com/docs/app-events/gdpr-complia... From them: "The Facebook SDK automatically initializes when the app is opened. When the SDK is initializing, it fetches app settings from Facebook. If you want to block all network requests to Facebook, you can disable automatic initialization." If you want to turn it off, you're supposed to set in your app'…

> If people are claiming that the SDK is still fetching despite adding that key, that could be breaking some compliance and consent laws... It is still a violation of GDPR as I as the user never have the chance to consent (or not consent!) to any data transfer to Facebook. But as no one seems to be willing to go after FB... sigh.