Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

github.com

Post reply on HN
Print view View original

371–376 of 376 posts

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#371

Post by grishka »

oblio wrote: post #332
ChrisMarshallNY wrote: post #323

Earlier quoted context omitted.

We are now in a “dependency-oriented programming environment” (D.O.P.E) world. One the one hand, it’s easy to sniff at the use of dependencies, when we have these kinds of disasters, but on the other hand, dependencies give us the ability to do truly great stuff. For example, I program Apple devices (not just iOS). I wrote my first Apple code in 1986, so I have some “prior art.” I’ve “seen it all.” I remember the day…

For Java you can actually control a lot of this through a security manager: https://stackoverflow.com/questions/5401281/preventing-syste... And I think you can even control the loading through a custom class loader. It's a bit of work but it should give you decent oversight over the dependencies you really don't trust but have to use.

You can hack things through reflection. You can use Gradle directives to specifically exclude certain dependencies of your dependencies. You can use ProGuard to strip out the parts of libraries you don't need.

A side note: on Android, class loaders are definitely of no use for this purpose. Android runtime uses its custom bytecode language and file format that packs the entire classpath of your app into one .dex file. You can't load separate classes from these, only the entire thing all at once.

(yes there's multidex for large apps but the way classes are split between files is rather random in my experience)

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#372

Post by geofft »

marcus_holmes wrote: post #318
paranoidrobot wrote: post #254

Earlier quoted context omitted.

Is your objection the 5% or that it's going to healthcare costs?

I think the objection is that for most of western civilisation, healthcare costs are paid for by taxes not employers

OK, but those taxes are paid by someone (usually business taxes). I am strongly in favor of government-funded healthcare but the number of countries where the government can be funded by, like, drilling oil is very small, so I think my argument stands - some portion of the money I spend on dinner is going not towards things that directly produce my dinner but things that someone else thinks is worthwhile. Even if I agree with it, it's not my decision.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#373

Post by ynx »

red_admiral wrote: post #305
saagarjha wrote: post #54

Earlier quoted context omitted.

(For the iOS engineers reading along: please don't put network calls in +load, or __attribute__((constructor)), or a C++ static variable, or whatever other clever way you think you can get code execution before main.)

For the iOS developers reading along: please ban this behaviour in a future version?

This is akin to banning any application that calls 'malloc' and 'free'.

To do ban static constructors they'd have to literally ban anything that links the C++ runtime, which is almost literally everything on your system.

Not possible.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#374

Post by giantDinosaur »

geofft wrote: post #372
marcus_holmes wrote: post #318

Earlier quoted context omitted.

I think the objection is that for most of western civilisation, healthcare costs are paid for by taxes not employers

OK, but those taxes are paid by someone (usually business taxes). I am strongly in favor of government-funded healthcare but the number of countries where the government can be funded by, like, drilling oil is very small, so I think my argument stands - some portion of the money I spend on dinner is going not towards things that directly produce my dinner but things that someone else thinks is worthwhile. Even if I a…

Structuring something in the interests of what benefits them won't necessarily align with what benefits you, since the actual structure of the relationship matters, as brief regard to my flippant comment on your analogy. It isn't about what % of dinner goes to healthcare - it's (and I was assuming some hideous employer-pays healthcare system) rather about the system which is built to align incentives and benefits in certain ways. That is, I stand to lose in many situations if healthcare is provided directly by the payments of my customers, or whatever. Likewise, with privacy, it isn't just that 'it spies', it's that what it purports to aid me in is likely coincidental. Just like a targeted advertisement actually really benefiting me is effectively irrelevant to the advertiser - it's just nice if our incentives happen to align, for one brief moment. :-)

It isn't so nice when they don't.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#375

Post by red_admiral »

ynx wrote: post #373
red_admiral wrote: post #305

Earlier quoted context omitted.

For the iOS developers reading along: please ban this behaviour in a future version?

This is akin to banning any application that calls 'malloc' and 'free'. To do ban static constructors they'd have to literally ban anything that links the C++ runtime, which is almost literally everything on your system. Not possible.

Not 'ban static constructors', sorry if I wasn't clear. Ban network I/O before main() has started.

Re: Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

#376

Post by admax88q »

edmundsauto wrote: post #192
admax88q wrote: post #159

Earlier quoted context omitted.

This is really just a variant of the "and yet you participate in society, hmmm" argument. At some point users are allowed to complain about shady behaviour done by huge corporations with resources they use to try to thrust their way into everyones lives.

And at some point, companies are allowed to make their own decisions about how they want to instrument and monetize their products. This general complaint about not liking a component of someone else's software doesn't resonate with me at all. Not that you're wrong, but we just have different values. I sometimes will load a website that uses React when really it's just a static content site. It just gets tiring, and…

Obviously companies can choose how they want monetize, that doesn't mean you are obligated to defend then when what they're doing is scummy it immoral.

Why deflect criticism.by saying "well you don't have to use their app now do you?"

When a person does something immoral rarely do people defend them by saying "well you don't have to engage with them now do you?

Why not debate the morality or legitimacy of the act in question rather than deflect try to deflect the criticisms?

Post reply on HN