13 ms·

Facebook iOS SDK Remotely Crashing Spotify, TikTok, Pinterest, Winno and More

824 points by MCKapur 6y ago

saagarjha 6y ago
From the crash log, it looks like the server response it's getting back is missing a field that the SDK wants. Facebook should be able to fix this on their end? Edit: from the issue it looks like they've done something, but people are still reporting crashes…
- MCKapur 6y ago
  it will probably take time to propagate (edit: though i didn't expect this much time, still crashing!)
- Matthias247 6y ago
  The description is definitely weird. Any server change change should never crash an app, which should have proper validation for all data that it receives. Thereby the mitigation "to update something on the server that takes time to propagate" also sounds wrong more like a rollback/mitigation than a fix of the actual issue.
floatingatoll 6y ago
18 minutes ago: > Server side change is already reverted. The crash will vanish.
- jfim 6y ago
  > Still crashing 30 minutes after your revert. Are you sure you reverted the right thing?
MCKapur 6y ago
Also: Tinder, Venmo, GrubHub (think of the botched deliveries heh), and more. An ongoing list here: https://twitter.com/aburninghilll/status/1258169688959352832 https://twitter.com/aburninghilll/status/1258169688959352832 Also see: https://github.com/facebook/facebook-ios-sdk/issues/1373 https://github.com/facebook/facebook-ios-sdk/issues/1373
lennykhazan 6y ago
guess we're back to "move fast and break things"
- Austin_Conlon 6y ago
  Move slowly with unstable infra.
lucasar 6y ago
You beat me by a couple of minutes. Dear Facebook: Please move slower and break fewer things. Thank you very much.
a-wu 6y ago
I hope that this incident and the Zoom incident will motivate app developers to remove the Facebook SDK when possible.
- GrinningFool 6y ago
  In most cases, it's not really up to the app developers.
surferbayarea 6y ago
Why is facebook spyware part of Spotify. I signed up to Spotify via email not facebook login.
- MCKapur 6y ago
  i mean, they offer FB sign in in the app, so the FB SDK is bundled with the app binary. looks like the mere presence of the library is causing crashes. someone on a related GH thread noted they commented out the code invoking the FB SDK but the issue remained.
  - surferbayarea 6y ago
    Yeah these SDKs are siphoning off data without authorization like your location, songs you listen to and who knows what else (eg other processes or apps running on your phone). Eg the latest iOS exploit allows any app to get access to all SMS data. Tech companies of today trample upon individual privacy openly. Amazing!
    - MCKapur 6y ago
      i'm by a longshot no facebook fan but... are you sure the SDK can actually siphon out what songs you listen or your location from the app it's sandboxed in (which, BTW, is in its own sandbox from an iOS system POV, and also has its own set of permissions)?
      - lucasar 6y ago
        I am an iOS developer and most likely the problem is related to configuration and basic analytics, not "siphoning" app data. Offending code : if (restrictiveParams[eventName][@"is_deprecated_event"]) { [deprecatedEventSet addObject:eventName]; } So, the iOS library does not check for nil, and whatever the server is returning does not have the expected content. Lame.
        bryansum 6y ago
joeblau 6y ago
This is a good resource to see who is being impacted[1]. [1] - https://downdetector.com https://downdetector.com
firloop 6y ago
I block all Facebook domains with the NextDNS iOS app — didn't seem to be affected by this. Blocking spyware has its perks.
- elliekelly 6y ago
  Same here and I’ve always been a bit skeptical about how well it actually works but I’m pleasantly surprised by the results of this impromptu test!
- notRobot 6y ago
  Ditto! facebook.com fbcdn.com fbcdn.net fbsbx.com fb.com instagram.com (^ These won't break WhatsApp) NextDNS automatically blocks subdomains. More info here: https://qz.com/1234502/how-to-block-facebook-all-the-urls-you-need-to-block-to-actually-stop-using-facebook/ https://qz.com/1234502/how-to-block-facebook-all-the-urls-yo...
- wp381640 6y ago
  I wish there were an easy way to deploy rpi to people I know much in the same way it's easy to tell them to install uBlock Origin
ExactActuation 6y ago
But all of the engineers passed LeetCode, how could this be?
- empath75 6y ago
  If only they knew how to balance a binary search tree.
- himaraya 6y ago
  Questions went stale
- ignoramous 6y ago
  Facebook engineering generally is super competent. Leet code or not, such slip ups are bound to happen from time to time. True test of competence would be these mistakes don't repeat and that they learn from it, which I'm pretty sure they would.
  - mlthoughts2018 6y ago
    > “ True test of competence would be these mistakes don't repeat and that they learn from it, which I'm pretty sure they would.” Which begs the question why test engineers with leetcode trivia bullshit. You are yourself emphasizing why their interview process (and they are just one of many offenders) is so bananas inappropriate.
    - pb7 6y ago
      One single bug is why their process is bananas inappropriate? I really hope all of your code is perfect every single time to be acting so high and mighty.
      - mlthoughts2018 6y ago
        This is so shortsighted it’s painful. You’re describing the attitude Facebook takes towards candidates, not the attitude I take towards anything. Candidates should be saying to Facebook, “ I really hope all of your code is perfect every single time to be acting so high and mighty” and absolutely making a huge deal out of a case like this when it isn’t.
aboringusername 6y ago
I really think the use of remote, undocumented and unknown code just needs to end. Including the SDK which can make changes invisibly should never be an acceptable practice. And it's why I am weary of installing apps in general. Tip: use f-droid, check privacy exodus and stick to the browser where possible, where you can have much greater control, and not be spied on by FB.
rdxm 6y ago
file this under: you get exactly what you deserve....
sreekotay 6y ago
Unpopular opinion: bugs happen. Be bold.
- ksml 6y ago
  What's "be bold" supposed to mean?
  - saagarjha 6y ago
    Break every application that links your SDK, of course.
  - shaggyfrog 6y ago
    git force push, and damn the torpedoes
  - vvG94KbDUtRa 6y ago
    remove the headphone jack of course
- codezero 6y ago
  This should not be the case for a library developer. If you accept the consequences for your app, that's fine, but you shouldn't be expected to accept the consequences of a library developer being careless.
- sbmthakur 6y ago
  That's true. But other apps crashing due to it is much worse. Facebook would be bold if theu opens address the issue.
user982 6y ago
Zoom dodged this bullet.
- ilikehurdles 6y ago
  And got so much flak for it. How much "zomg you're spying on me" press are the other 50% of the iOS ecosystem going to receive for doing the same thing Zoom did, going on a decade.
  - Nextgrid 6y ago
    Just because others are doing it doesn't make it okay.
felubra 6y ago
This comment made my day LOL https://github.com/facebook/facebook-ios-sdk/issues/1374#issuecomment-624939133 https://github.com/facebook/facebook-ios-sdk/issues/1374#iss...
veeti 6y ago
Same thing happened with Google Maps SDK just a few weeks ago. https://www.reddit.com/r/androiddev/comments/g6t8fu/google_maps_sdk_error_started_popping_on_last_hour/ https://www.reddit.com/r/androiddev/comments/g6t8fu/google_m...
gazelle21 6y ago
Wow heads will roll
yllus 6y ago
For those wondering why the Facebook SDK is so widely used in popular mobile apps: Facebook Login is actually in the minority of reasons to add the Facebook SDK to your mobile app. The vast majority of apps will add the Facebook SDK because it contains Facebook App Ads; a library that "completes the circle" in terms of finding out how effectively the ads you ran on Facebook were at getting people to download, install and run your mobile app. So really the Facebook SDK is there to collect data of that advertisement being effective and provides both Facebook and the mobile app developer with knowledge of how their ad spend went. Is that "spyware"? Some would call it merely wanting to know if your marketing budget was wisely spent - I suppose a lot depends on what data it collects on people. More info: https://developers.facebook.com/docs/app-ads https://developers.facebook.com/docs/app-ads
- w-j-w 6y ago
  Why on Earth is it the advertiser's perspective that decides what is spyware. This is a consumer rights issue. As a user, I don't care what the intentions of the spying are.
- mrspeaker 6y ago
  If you squint then the Venn diagram of "spyware" and "knowing if your marketing budget was wisely spent" is a circle.
  - jagged-chisel 6y ago
    No need to squint, just cross your eyes ever-so-slightly
- Nicksil 6y ago
  >Is that "spyware"? Yes, absolutely. It uses energy and bandwidth I paid for to surreptitiously transmit my information for use which will solely benefit Facebook and the software developer.
  - cjhopman 6y ago
    That definition is rather too broad. It makes basically everything spyware which dilutes the word too much to be useful.
pkage 6y ago
Looks like it's back to normal (ish) now. I'm curious as to what kind of testing they have that this wasn't caught by a test suite though--login integration seems like an incredibly important thing to not break.
bvandewalle 6y ago
Is there a list somewhere of all the apps importing the spyware Facebook SDK?
fooey 6y ago
Seems to be some suggestions now that apps were continuing to crash even after commenting out the FB implementation because FB is managing to do remote API calls just because the framework is linked. https://github.com/facebook/facebook-ios-sdk/issues/1373#issuecomment-624944045 https://github.com/facebook/facebook-ios-sdk/issues/1373#iss... > It does not matter. Their libraries are dynamic, and they abuse +load functions for classes with some business logic calls. So, +load will be called anyway on the application launch when dyld loads all linked frameworks. and > I really don't understand why it is still crashing when we turn it off? Could you please explain, why there is a remote connection even we comment out the implementation? Linking binary framework just enough to break things down, why? What do you do in background? Sending or receiving some data even it's not been initialized?
- saagarjha 6y ago
  (For the iOS engineers reading along: please don't put network calls in +load, or __attribute__((constructor)), or a C++ static variable, or whatever other clever way you think you can get code execution before main.)
  - favorited 6y ago
    Even better: don't override +load or use static constructors!
    - saagarjha 6y ago
      Eh, I wouldn't go that far; they do have their uses. But for a SDK author, it pays to be excessively cautious when putting things on the application startup path. (Something which the Facebook is well aware of, as the dyld session is always full of their company's engineers, and the architecture of their app shows that put effort into meeting launch deadlines…)
      - favorited 6y ago
        Every bad thing has its uses. If an SDK author wants to be a responsible participant in the app's startup path, it will defer its own setup to the app. `__attribute__((constructor))` is most obviously a hack – like any great hack, it is useful enough to be implemented everywhere, but it will never be standardized because everyone acknowledges that it sucks. I used to use it! But it is extremely limited in its usefulness, and there are always better solutions to the problem.
g_p 6y ago
Perhaps this outage will raise awarenesses more broadly as to the prevalence of "non essential" third party SDKs like these, and the risk that their failure can significantly impact on the wider ecosystem. I can't imagine Apple will be all too pleased by this. Perhaps time for them to look at clamping down on SDKs that make remote network requests? (Given they have their own private sign in system now as well, they might even have a secondary incentive)
- dylan604 6y ago
  Not likely. FB has made it too easy, and developers are lazy. For the marketing/sales/PR types of the company that made the app, the info the SDK returns is exactly the type of information they want/need. At the end of the day, the "morality" of a developer will always come second to the sales/marketing/PR people. After all, you're just a developer, and there's a line a mile long of people waiting to replace you.
- akmarinov 6y ago
  Yes, please. Firebase should be next, requiring you to include a whole bunch of Firebase lib crap just to use Crashlytics.
- munsters 6y ago
  At the very least, this might spawn some discussion around being able to remotely enable/disable SDKs, from a server that you control. Last week it was Google Maps, today Facebook SDK...
- rimliu 6y ago
  From June 30th, 2020: "Apps that authenticate or set up user accounts must support Sign in with Apple if required by guideline 4.8 of the App Store Review Guidelines."
jasonlingx 6y ago
> This is insane, half of the apps on my phone aren't launching! > Please move slower and break fewer things. Thank you.
vmception 6y ago
Hm my whatsapp crashed midcall today, wonder if they use the Facebook SDK or something else
- alex-wallish 6y ago
  Given that whatsapp is owned by facebook, that seems very likely.
  - vmception 6y ago
    that's exactly why I was wondering if they use something else, a better internal shared library for accessing facebook services
32gbsd 6y ago
good
lifeAsNerd 6y ago
But Apple advertising says we have privacy!
bilifuduo 6y ago
Guess Joma was right: https://www.youtube.com/watch?v=rR4n-0KYeKQ https://www.youtube.com/watch?v=rR4n-0KYeKQ
HerbsMan 6y ago
Facebook is one of the biggest cancer and its continuous success indicates global stupidity. Bravo :claps:
AzzieElbab 6y ago
10 to 1 it is going to be about SDKs generated from php with its bizzaire associate arrays.
johnghanks 6y ago
lmfao go back to your bomb shelter, Grandpa.
deleted 6y ago
[deleted]
gwittel 6y ago
Ouch. Not knowing how the iOS apps are written, two questions come to mind: 1) Why wasn’t the SDK written to tolerate bad data and fail gracefully? 2) Could clients integrating the SDK be written to tolerate failures like this?
whatthesmack 6y ago
We have a few thousand apps on the App Store and got bit by this today. The SDK is very useful for a smooth login experience if the user has the Facebook app installed, because your app can offer Facebook as a login option, then just pop the user over to the Facebook app, they can tap “okay” (or whatever), and jump back to your app. That said, we’re going to rip this thing out of our apps ASAP. No framework should be calling network code in “+load”. The convenience for the user (and the dirty tracking Facebook apparently does) is just not worth the trade-off of handing our app’s stability over to Facebook.
- jeffbee 6y ago
  How can one developer have thousands of apps? It sounds just like a giant scattergun for malware. There are not 1000 distinct useful ways to use an iPhone.
  - RandallBrown 6y ago
    A consulting company or a company that makes "white label" apps like for restaurants or stores.
    - jeffbee 6y ago
      Can we agree that each restaurant having a separate app is one of the dumbest outcomes imaginable?
      - whatthesmack 6y ago
        Sure, unless you’re one of those restaurants that wants their own app.
      - busymom0 6y ago
        That's not how it actually is. Apple actually rejects those type of template apps. The restaurants use an ad-hoc way of installing the apps. So those apps are only available to the restaurant for example.
scottmf 6y ago
I’m calling it “lefb-pad”
outside1234 6y ago
Ah that is what is happening!!! Thanks HN. :)
wondo 6y ago
wondo wondo wondo
lancefisher 6y ago
We found a couple workarounds while Facebook was busy fixing this. 1. Airplane mode 2. Block facebook.com as adult content under Settings | Screen Time | Content Restrictions | Web Content | Limit Adult Websites | Add a site. 3. Block facebook.com at your router. Option 2 could be helpful if you want to block it for privacy reasons.
- Nextgrid 6y ago
  Does the adult filter work in apps? If so this seems like a lovely workaround for the lack of firewall.
  - lancefisher 6y ago
    It worked to fix this, so I’m assuming so.
    - iostestadult 6y ago
      I tried adding spotify.com as a limited adult website and I can still use the Spotify app normally. So either I'm missing something or it can't be used as a firewall.
      - argestes 6y ago
        You might be using their magical p2p network.
        iostestadult 6y ago
        I tried with various app and I can’t break any of them. I’d be really interested in a firewall for iOS
  - govg 6y ago
    The adult filter probably works like a DNS bkackhole and simply bans those websites from getting resolved.
yumraj 6y ago
Is there a comprehensive list of applications that have the FB SDK in them so that I can decide to not install those? Does Apple use FB SDK in their apps? I think not, but can someone confirm?
bschwindHN 6y ago
Hi everyone, Please use the oauth-only version for login and strip the facebook SDK garbage from your apps. It seems it's not worth the trouble.
- drawkbox 6y ago
  The Facebook SDK is a single point of failure it seems. If you must integrate Facebook, it is better to use OAuth + API and then control every call, only necessary ones needed i.e. login, friends, maybe game leaderboards, profile photo, etc. Not sure why people are still putting the Facebook SDK in their apps, it is basically malware and tracking for authoritarian ends [1][2]. Engineers are supposed to be anti-authoritarians. Engineers are supposed to be into decentralization and distributed systems, and not have single points of failure like libs with hard crashes that inject network calls that don't fail gracefully before your app can even launch. [1] https://www.nytimes.com/2017/11/05/world/yuri-milner-facebook-twitter-russia.html https://www.nytimes.com/2017/11/05/world/yuri-milner-faceboo... [2] https://www.theguardian.com/news/2017/nov/05/russia-funded-facebook-twitter-investments-kushner-investor https://www.theguardian.com/news/2017/nov/05/russia-funded-f...
  - busymom0 6y ago
    > Engineers are supposed to be anti-authoritarians Strongly disagree on this. Exact opposite maybe but I don't want to generalize. Modern authoritarian tactics are pretty much impossible without engineering.
    - ergl 6y ago
      Wait, are you saying that (software) engineers should _actually_ be authoritarian? And you suggest this is because otherwise "authoritarian tactics" wouldn't work?
      - busymom0 6y ago
        No, I did not say that. I am not even talking about what they should or shouldn't be. There's no set rule which says engineers are supposed to be pro-authoritarians or anti-authoritarians. I was disagreeing with what the parent said: "Engineers are supposed to be anti-authoritarians." I take that to mean that the person thinks engineers are anti-authoritarians - which is simply false and not what happens in real life. Engineers are often enablers of authoritarians. And this is a bad thing but just fact of life. Humans are flawed and greedy for power. There are higher chances of someone with power to abuse it (engineer in this example but could apply to others too).
trustfundbaby 6y ago
Wow. At almost exactly the time that report was filed ... about 30-40 Minutes, my spotify ios app started crashing. I was listening to a song on my desktop, and wanted to share it on my instagram so I went to the app to do it. everytime I opened up the app it would crash immediately, I restarted my phone, tried it again, and it was fine for about 5 seconds and then crash ... crash ... crash ... I filed a report with Spotify and by the time they got back to me, the problem had gone away ... I thought it was very odd, until I read this post ... I guess now I know what happened.
anticensor 6y ago
This is surely a competition violation, wordly blocking competing products from operating.
nickpinkston 6y ago
Move fast and break other things
asquabventured 6y ago
Waze, a company owned by Google was also broken and force crashing over and over again for a few hours. Whenever I hear of some Facebook offering all I think of is when you dance with the devil, you shouldn't be surprised when you get burned.
wicket 6y ago
Is this a library or an SDK? Why on earth would you install an SDK on an end-user's phone?
- jannes 6y ago
  The SDK contains the library. I guess in app developer circles these terms are conflated.
fxtentacle 6y ago
How to gain market share? Release a breaking server-side update and "forget" to inform other vendors in time so that their apps crash, while yours do not.
3gg 6y ago
If the spying ecosystem that these corporations have brought upon us were not reason enough for disappointment, one need only have a glance at the github thread to be quickly dismayed by the carelessness and ignorance of these so-called "developers" who, had they ever enjoyed the slightest taste for engineering, have lost it completely and have become mere peons of code greasing the advertising cogwheels of their digital overlords. To load a secretive, abusive, third-party dependency, have your "app" crash, and then demand explanations must be the pinnacle of engineering stupidity.
tomduncalf 6y ago
A similar thing happened with Google Maps recently: https://twitter.com/GergelyOrosz/status/1253608276660551680 https://twitter.com/GergelyOrosz/status/1253608276660551680 Not sure what the lesson is, other than that you can’t trust third party code, even if it’s written by the worlds largest companies!
cpv 6y ago
Maybe this will motivate product owners, developers, marketers, to start thinking before implementing a dozen of SDKs in a mobile app (or website). It's understandable when you need some analytics/crash reporting, but it becomes a privacy and ethics question when a lot of data is wandering around, and even better, crashes your app. And the users will blame you, they don't even know how many SDKs are there and what they are doing.
- sakarisson 6y ago
  > And the users will blame you Rightfully so. If you add an SDK to you app, it's your fault if the SDK causes your app to crash.
xenospn 6y ago
I had no idea why my app was suddenly crashing multiple times all of a sudden. God fucking damnit.
deleted 6y ago
[deleted]
0h139 6y ago
Is there a postmortem available on this? Perhaps I missed it in the sea of comments.
- seumars 6y ago
  I've always wondered how the word postmortem found its way into tech. Are we calling code reviews autopsies now?
addicted2Code 6y ago
I had to remove the SDK a few months ago due to it causing crashes. If I remember correctly they injected some code into didSelectRowAtIndexPath for table / collection views...Looks like its fixed now but I definitely won't be adding it back, https://github.com/facebook/facebook-ios-sdk/issues/1318 https://github.com/facebook/facebook-ios-sdk/issues/1318
sferik 6y ago
At least they moved fast.
brenden2 6y ago
This is one of several reasons why I refuse to install apps unless I absolutely must. You have no way of knowing what kind of spyware is bundled with them, and there's no way to block it (like you can in a proper browser with uBlock Origin).
manigandham 6y ago
For all the privacy stuff that Apple does on Safari, it does absolutely nothing against the tracking issues in the mobile app ecosystem. The unspoken rule is because apps make money for Apple and websites don't.
kjgkjhfkjf 6y ago
This is a nice demonstration of why exceptions, in particular untyped exceptions, are a major liability.

824 points by MCKapur 6y ago

From the crash log, it looks like the server response it's getting back is missing a field that the SDK wants. Facebook should be able to fix this on their end? Edit: from the issue it looks like they've done something, but people are still reporting crashes…

MCKapur 6y ago
it will probably take time to propagate (edit: though i didn't expect this much time, still crashing!)
Matthias247 6y ago
The description is definitely weird. Any server change change should never crash an app, which should have proper validation for all data that it receives. Thereby the mitigation "to update something on the server that takes time to propagate" also sounds wrong more like a rollback/mitigation than a fix of the actual issue.

floatingatoll 6y ago

18 minutes ago: > Server side change is already reverted. The crash will vanish.

jfim 6y ago
> Still crashing 30 minutes after your revert. Are you sure you reverted the right thing?

MCKapur 6y ago

Also: Tinder, Venmo, GrubHub (think of the botched deliveries heh), and more. An ongoing list here: https://twitter.com/aburninghilll/status/1258169688959352832 https://twitter.com/aburninghilll/status/1258169688959352832 Also see: https://github.com/facebook/facebook-ios-sdk/issues/1373 https://github.com/facebook/facebook-ios-sdk/issues/1373

lennykhazan 6y ago

guess we're back to "move fast and break things"

Austin_Conlon 6y ago
Move slowly with unstable infra.

lucasar 6y ago

You beat me by a couple of minutes. Dear Facebook: Please move slower and break fewer things. Thank you very much.

a-wu 6y ago

I hope that this incident and the Zoom incident will motivate app developers to remove the Facebook SDK when possible.

GrinningFool 6y ago
In most cases, it's not really up to the app developers.

surferbayarea 6y ago

Why is facebook spyware part of Spotify. I signed up to Spotify via email not facebook login.

MCKapur 6y ago
i mean, they offer FB sign in in the app, so the FB SDK is bundled with the app binary. looks like the mere presence of the library is causing crashes. someone on a related GH thread noted they commented out the code invoking the FB SDK but the issue remained.
- surferbayarea 6y ago
  Yeah these SDKs are siphoning off data without authorization like your location, songs you listen to and who knows what else (eg other processes or apps running on your phone). Eg the latest iOS exploit allows any app to get access to all SMS data. Tech companies of today trample upon individual privacy openly. Amazing!
  - MCKapur 6y ago
    i'm by a longshot no facebook fan but... are you sure the SDK can actually siphon out what songs you listen or your location from the app it's sandboxed in (which, BTW, is in its own sandbox from an iOS system POV, and also has its own set of permissions)?
    - lucasar 6y ago
      I am an iOS developer and most likely the problem is related to configuration and basic analytics, not "siphoning" app data. Offending code : if (restrictiveParams[eventName][@"is_deprecated_event"]) { [deprecatedEventSet addObject:eventName]; } So, the iOS library does not check for nil, and whatever the server is returning does not have the expected content. Lame.
      - bryansum 6y ago

joeblau 6y ago

This is a good resource to see who is being impacted[1]. [1] - https://downdetector.com https://downdetector.com

firloop 6y ago

I block all Facebook domains with the NextDNS iOS app — didn't seem to be affected by this. Blocking spyware has its perks.

elliekelly 6y ago
Same here and I’ve always been a bit skeptical about how well it actually works but I’m pleasantly surprised by the results of this impromptu test!
notRobot 6y ago
Ditto! facebook.com fbcdn.com fbcdn.net fbsbx.com fb.com instagram.com (^ These won't break WhatsApp) NextDNS automatically blocks subdomains. More info here: https://qz.com/1234502/how-to-block-facebook-all-the-urls-you-need-to-block-to-actually-stop-using-facebook/ https://qz.com/1234502/how-to-block-facebook-all-the-urls-yo...
wp381640 6y ago
I wish there were an easy way to deploy rpi to people I know much in the same way it's easy to tell them to install uBlock Origin

ExactActuation 6y ago

But all of the engineers passed LeetCode, how could this be?

empath75 6y ago
If only they knew how to balance a binary search tree.
himaraya 6y ago
Questions went stale
ignoramous 6y ago
Facebook engineering generally is super competent. Leet code or not, such slip ups are bound to happen from time to time. True test of competence would be these mistakes don't repeat and that they learn from it, which I'm pretty sure they would.
- mlthoughts2018 6y ago
  > “ True test of competence would be these mistakes don't repeat and that they learn from it, which I'm pretty sure they would.” Which begs the question why test engineers with leetcode trivia bullshit. You are yourself emphasizing why their interview process (and they are just one of many offenders) is so bananas inappropriate.
  - pb7 6y ago
    One single bug is why their process is bananas inappropriate? I really hope all of your code is perfect every single time to be acting so high and mighty.
    - mlthoughts2018 6y ago
      This is so shortsighted it’s painful. You’re describing the attitude Facebook takes towards candidates, not the attitude I take towards anything. Candidates should be saying to Facebook, “ I really hope all of your code is perfect every single time to be acting so high and mighty” and absolutely making a huge deal out of a case like this when it isn’t.

aboringusername 6y ago

I really think the use of remote, undocumented and unknown code just needs to end. Including the SDK which can make changes invisibly should never be an acceptable practice. And it's why I am weary of installing apps in general. Tip: use f-droid, check privacy exodus and stick to the browser where possible, where you can have much greater control, and not be spied on by FB.

rdxm 6y ago

file this under: you get exactly what you deserve....

sreekotay 6y ago

Unpopular opinion: bugs happen. Be bold.

ksml 6y ago
What's "be bold" supposed to mean?
- saagarjha 6y ago
  Break every application that links your SDK, of course.
- shaggyfrog 6y ago
  git force push, and damn the torpedoes
- vvG94KbDUtRa 6y ago
  remove the headphone jack of course
codezero 6y ago
This should not be the case for a library developer. If you accept the consequences for your app, that's fine, but you shouldn't be expected to accept the consequences of a library developer being careless.
sbmthakur 6y ago
That's true. But other apps crashing due to it is much worse. Facebook would be bold if theu opens address the issue.

user982 6y ago

Zoom dodged this bullet.

ilikehurdles 6y ago
And got so much flak for it. How much "zomg you're spying on me" press are the other 50% of the iOS ecosystem going to receive for doing the same thing Zoom did, going on a decade.
- Nextgrid 6y ago
  Just because others are doing it doesn't make it okay.

felubra 6y ago

This comment made my day LOL https://github.com/facebook/facebook-ios-sdk/issues/1374#issuecomment-624939133 https://github.com/facebook/facebook-ios-sdk/issues/1374#iss...

veeti 6y ago

Same thing happened with Google Maps SDK just a few weeks ago. https://www.reddit.com/r/androiddev/comments/g6t8fu/google_maps_sdk_error_started_popping_on_last_hour/ https://www.reddit.com/r/androiddev/comments/g6t8fu/google_m...

gazelle21 6y ago

Wow heads will roll

yllus 6y ago

For those wondering why the Facebook SDK is so widely used in popular mobile apps: Facebook Login is actually in the minority of reasons to add the Facebook SDK to your mobile app. The vast majority of apps will add the Facebook SDK because it contains Facebook App Ads; a library that "completes the circle" in terms of finding out how effectively the ads you ran on Facebook were at getting people to download, install and run your mobile app. So really the Facebook SDK is there to collect data of that advertisement being effective and provides both Facebook and the mobile app developer with knowledge of how their ad spend went. Is that "spyware"? Some would call it merely wanting to know if your marketing budget was wisely spent - I suppose a lot depends on what data it collects on people. More info: https://developers.facebook.com/docs/app-ads https://developers.facebook.com/docs/app-ads

w-j-w 6y ago
Why on Earth is it the advertiser's perspective that decides what is spyware. This is a consumer rights issue. As a user, I don't care what the intentions of the spying are.
mrspeaker 6y ago
If you squint then the Venn diagram of "spyware" and "knowing if your marketing budget was wisely spent" is a circle.
- jagged-chisel 6y ago
  No need to squint, just cross your eyes ever-so-slightly
Nicksil 6y ago
>Is that "spyware"? Yes, absolutely. It uses energy and bandwidth I paid for to surreptitiously transmit my information for use which will solely benefit Facebook and the software developer.
- cjhopman 6y ago
  That definition is rather too broad. It makes basically everything spyware which dilutes the word too much to be useful.

pkage 6y ago

Looks like it's back to normal (ish) now. I'm curious as to what kind of testing they have that this wasn't caught by a test suite though--login integration seems like an incredibly important thing to not break.

bvandewalle 6y ago

Is there a list somewhere of all the apps importing the spyware Facebook SDK?

fooey 6y ago

Seems to be some suggestions now that apps were continuing to crash even after commenting out the FB implementation because FB is managing to do remote API calls just because the framework is linked. https://github.com/facebook/facebook-ios-sdk/issues/1373#issuecomment-624944045 https://github.com/facebook/facebook-ios-sdk/issues/1373#iss... > It does not matter. Their libraries are dynamic, and they abuse +load functions for classes with some business logic calls. So, +load will be called anyway on the application launch when dyld loads all linked frameworks. and > I really don't understand why it is still crashing when we turn it off? Could you please explain, why there is a remote connection even we comment out the implementation? Linking binary framework just enough to break things down, why? What do you do in background? Sending or receiving some data even it's not been initialized?

saagarjha 6y ago
(For the iOS engineers reading along: please don't put network calls in +load, or __attribute__((constructor)), or a C++ static variable, or whatever other clever way you think you can get code execution before main.)
- favorited 6y ago
  Even better: don't override +load or use static constructors!
  - saagarjha 6y ago
    Eh, I wouldn't go that far; they do have their uses. But for a SDK author, it pays to be excessively cautious when putting things on the application startup path. (Something which the Facebook is well aware of, as the dyld session is always full of their company's engineers, and the architecture of their app shows that put effort into meeting launch deadlines…)
    - favorited 6y ago
      Every bad thing has its uses. If an SDK author wants to be a responsible participant in the app's startup path, it will defer its own setup to the app. `__attribute__((constructor))` is most obviously a hack – like any great hack, it is useful enough to be implemented everywhere, but it will never be standardized because everyone acknowledges that it sucks. I used to use it! But it is extremely limited in its usefulness, and there are always better solutions to the problem.

g_p 6y ago

Perhaps this outage will raise awarenesses more broadly as to the prevalence of "non essential" third party SDKs like these, and the risk that their failure can significantly impact on the wider ecosystem. I can't imagine Apple will be all too pleased by this. Perhaps time for them to look at clamping down on SDKs that make remote network requests? (Given they have their own private sign in system now as well, they might even have a secondary incentive)

dylan604 6y ago
Not likely. FB has made it too easy, and developers are lazy. For the marketing/sales/PR types of the company that made the app, the info the SDK returns is exactly the type of information they want/need. At the end of the day, the "morality" of a developer will always come second to the sales/marketing/PR people. After all, you're just a developer, and there's a line a mile long of people waiting to replace you.
akmarinov 6y ago
Yes, please. Firebase should be next, requiring you to include a whole bunch of Firebase lib crap just to use Crashlytics.
munsters 6y ago
At the very least, this might spawn some discussion around being able to remotely enable/disable SDKs, from a server that you control. Last week it was Google Maps, today Facebook SDK...
rimliu 6y ago
From June 30th, 2020: "Apps that authenticate or set up user accounts must support Sign in with Apple if required by guideline 4.8 of the App Store Review Guidelines."

jasonlingx 6y ago

> This is insane, half of the apps on my phone aren't launching! > Please move slower and break fewer things. Thank you.

vmception 6y ago

Hm my whatsapp crashed midcall today, wonder if they use the Facebook SDK or something else

alex-wallish 6y ago
Given that whatsapp is owned by facebook, that seems very likely.
- vmception 6y ago
  that's exactly why I was wondering if they use something else, a better internal shared library for accessing facebook services

32gbsd 6y ago

good

lifeAsNerd 6y ago

But Apple advertising says we have privacy!

bilifuduo 6y ago

Guess Joma was right: https://www.youtube.com/watch?v=rR4n-0KYeKQ https://www.youtube.com/watch?v=rR4n-0KYeKQ

HerbsMan 6y ago

Facebook is one of the biggest cancer and its continuous success indicates global stupidity. Bravo :claps:

AzzieElbab 6y ago

10 to 1 it is going to be about SDKs generated from php with its bizzaire associate arrays.

johnghanks 6y ago

lmfao go back to your bomb shelter, Grandpa.

deleted 6y ago

[deleted]

gwittel 6y ago

Ouch. Not knowing how the iOS apps are written, two questions come to mind: 1) Why wasn’t the SDK written to tolerate bad data and fail gracefully? 2) Could clients integrating the SDK be written to tolerate failures like this?

whatthesmack 6y ago

We have a few thousand apps on the App Store and got bit by this today. The SDK is very useful for a smooth login experience if the user has the Facebook app installed, because your app can offer Facebook as a login option, then just pop the user over to the Facebook app, they can tap “okay” (or whatever), and jump back to your app. That said, we’re going to rip this thing out of our apps ASAP. No framework should be calling network code in “+load”. The convenience for the user (and the dirty tracking Facebook apparently does) is just not worth the trade-off of handing our app’s stability over to Facebook.

jeffbee 6y ago
How can one developer have thousands of apps? It sounds just like a giant scattergun for malware. There are not 1000 distinct useful ways to use an iPhone.
- RandallBrown 6y ago
  A consulting company or a company that makes "white label" apps like for restaurants or stores.
  - jeffbee 6y ago
    Can we agree that each restaurant having a separate app is one of the dumbest outcomes imaginable?
    - whatthesmack 6y ago
      Sure, unless you’re one of those restaurants that wants their own app.
    - busymom0 6y ago
      That's not how it actually is. Apple actually rejects those type of template apps. The restaurants use an ad-hoc way of installing the apps. So those apps are only available to the restaurant for example.

scottmf 6y ago

I’m calling it “lefb-pad”

outside1234 6y ago

Ah that is what is happening!!! Thanks HN. :)

wondo 6y ago

wondo wondo wondo

lancefisher 6y ago

We found a couple workarounds while Facebook was busy fixing this. 1. Airplane mode 2. Block facebook.com as adult content under Settings | Screen Time | Content Restrictions | Web Content | Limit Adult Websites | Add a site. 3. Block facebook.com at your router. Option 2 could be helpful if you want to block it for privacy reasons.

Nextgrid 6y ago
Does the adult filter work in apps? If so this seems like a lovely workaround for the lack of firewall.
- lancefisher 6y ago
  It worked to fix this, so I’m assuming so.
  - iostestadult 6y ago
    I tried adding spotify.com as a limited adult website and I can still use the Spotify app normally. So either I'm missing something or it can't be used as a firewall.
    - argestes 6y ago
      You might be using their magical p2p network.
      - iostestadult 6y ago
        I tried with various app and I can’t break any of them. I’d be really interested in a firewall for iOS
- govg 6y ago
  The adult filter probably works like a DNS bkackhole and simply bans those websites from getting resolved.

yumraj 6y ago

Is there a comprehensive list of applications that have the FB SDK in them so that I can decide to not install those? Does Apple use FB SDK in their apps? I think not, but can someone confirm?

bschwindHN 6y ago

Hi everyone, Please use the oauth-only version for login and strip the facebook SDK garbage from your apps. It seems it's not worth the trouble.

drawkbox 6y ago
The Facebook SDK is a single point of failure it seems. If you must integrate Facebook, it is better to use OAuth + API and then control every call, only necessary ones needed i.e. login, friends, maybe game leaderboards, profile photo, etc. Not sure why people are still putting the Facebook SDK in their apps, it is basically malware and tracking for authoritarian ends [1][2]. Engineers are supposed to be anti-authoritarians. Engineers are supposed to be into decentralization and distributed systems, and not have single points of failure like libs with hard crashes that inject network calls that don't fail gracefully before your app can even launch. [1] https://www.nytimes.com/2017/11/05/world/yuri-milner-facebook-twitter-russia.html https://www.nytimes.com/2017/11/05/world/yuri-milner-faceboo... [2] https://www.theguardian.com/news/2017/nov/05/russia-funded-facebook-twitter-investments-kushner-investor https://www.theguardian.com/news/2017/nov/05/russia-funded-f...
- busymom0 6y ago
  > Engineers are supposed to be anti-authoritarians Strongly disagree on this. Exact opposite maybe but I don't want to generalize. Modern authoritarian tactics are pretty much impossible without engineering.
  - ergl 6y ago
    Wait, are you saying that (software) engineers should _actually_ be authoritarian? And you suggest this is because otherwise "authoritarian tactics" wouldn't work?
    - busymom0 6y ago
      No, I did not say that. I am not even talking about what they should or shouldn't be. There's no set rule which says engineers are supposed to be pro-authoritarians or anti-authoritarians. I was disagreeing with what the parent said: "Engineers are supposed to be anti-authoritarians." I take that to mean that the person thinks engineers are anti-authoritarians - which is simply false and not what happens in real life. Engineers are often enablers of authoritarians. And this is a bad thing but just fact of life. Humans are flawed and greedy for power. There are higher chances of someone with power to abuse it (engineer in this example but could apply to others too).

trustfundbaby 6y ago

Wow. At almost exactly the time that report was filed ... about 30-40 Minutes, my spotify ios app started crashing. I was listening to a song on my desktop, and wanted to share it on my instagram so I went to the app to do it. everytime I opened up the app it would crash immediately, I restarted my phone, tried it again, and it was fine for about 5 seconds and then crash ... crash ... crash ... I filed a report with Spotify and by the time they got back to me, the problem had gone away ... I thought it was very odd, until I read this post ... I guess now I know what happened.

anticensor 6y ago

This is surely a competition violation, wordly blocking competing products from operating.

nickpinkston 6y ago

Move fast and break other things

asquabventured 6y ago

Waze, a company owned by Google was also broken and force crashing over and over again for a few hours. Whenever I hear of some Facebook offering all I think of is when you dance with the devil, you shouldn't be surprised when you get burned.

wicket 6y ago

Is this a library or an SDK? Why on earth would you install an SDK on an end-user's phone?

jannes 6y ago
The SDK contains the library. I guess in app developer circles these terms are conflated.

fxtentacle 6y ago

How to gain market share? Release a breaking server-side update and "forget" to inform other vendors in time so that their apps crash, while yours do not.

3gg 6y ago

If the spying ecosystem that these corporations have brought upon us were not reason enough for disappointment, one need only have a glance at the github thread to be quickly dismayed by the carelessness and ignorance of these so-called "developers" who, had they ever enjoyed the slightest taste for engineering, have lost it completely and have become mere peons of code greasing the advertising cogwheels of their digital overlords. To load a secretive, abusive, third-party dependency, have your "app" crash, and then demand explanations must be the pinnacle of engineering stupidity.

tomduncalf 6y ago

A similar thing happened with Google Maps recently: https://twitter.com/GergelyOrosz/status/1253608276660551680 https://twitter.com/GergelyOrosz/status/1253608276660551680 Not sure what the lesson is, other than that you can’t trust third party code, even if it’s written by the worlds largest companies!

cpv 6y ago

Maybe this will motivate product owners, developers, marketers, to start thinking before implementing a dozen of SDKs in a mobile app (or website). It's understandable when you need some analytics/crash reporting, but it becomes a privacy and ethics question when a lot of data is wandering around, and even better, crashes your app. And the users will blame you, they don't even know how many SDKs are there and what they are doing.

sakarisson 6y ago
> And the users will blame you Rightfully so. If you add an SDK to you app, it's your fault if the SDK causes your app to crash.

xenospn 6y ago

I had no idea why my app was suddenly crashing multiple times all of a sudden. God fucking damnit.

deleted 6y ago

[deleted]

0h139 6y ago

Is there a postmortem available on this? Perhaps I missed it in the sea of comments.

seumars 6y ago
I've always wondered how the word postmortem found its way into tech. Are we calling code reviews autopsies now?

addicted2Code 6y ago

I had to remove the SDK a few months ago due to it causing crashes. If I remember correctly they injected some code into didSelectRowAtIndexPath for table / collection views...Looks like its fixed now but I definitely won't be adding it back, https://github.com/facebook/facebook-ios-sdk/issues/1318 https://github.com/facebook/facebook-ios-sdk/issues/1318

sferik 6y ago

At least they moved fast.

brenden2 6y ago

This is one of several reasons why I refuse to install apps unless I absolutely must. You have no way of knowing what kind of spyware is bundled with them, and there's no way to block it (like you can in a proper browser with uBlock Origin).

manigandham 6y ago

For all the privacy stuff that Apple does on Safari, it does absolutely nothing against the tracking issues in the mobile app ecosystem. The unspoken rule is because apps make money for Apple and websites don't.

kjgkjhfkjf 6y ago

This is a nice demonstration of why exceptions, in particular untyped exceptions, are a major liability.