10 ms·

App suddenly crashing on startup due to FBSDKRestrictiveDataFilterManager.m

596 points by reubensutton 6y ago

beshrkayali 6y ago
How/why does Spotify app use Facebook iOS SDK?
- lewisj489 6y ago
  You can share what you're listening to on Facebook "Lewisj489 is listening to Band on Spotify"
- johannes1234321 6y ago
  You can login to Spotify via Facebook as you can see in the web version: https://accounts.spotify.com/en/login/ https://accounts.spotify.com/en/login/ For doing that in a app they require the SDK, which then does all the spying for Facebook.
  - dictum 6y ago
    Why is the Facebook integration not lazy-loaded only for users who log in through an FB account?
    - johannes1234321 6y ago
      Because FB doesn't support that. Either you build it in and it runs some code when your app starts or you can't use it. I would vote for "not use it" but others want Facebook integration supported and happily share information on all their users to Facebook ... P.S. I believe part of this is also Apple, who don't like runtime loading of code, as that makes their verification harder, but I'm no iOS dev or user.
  - deleted 6y ago
    [deleted]
- deleted 6y ago
  [deleted]
jasonlingx 6y ago
> FB, Have you consider adding Continuous Integration and Functional Tests questions to your Interview's questionnaire? :)
docdeek 6y ago
I don’t use Facebook or Spotify but it seems the people who coded the NYT Crossword app do - crashing for the last hour or more. Frustrating...
jeremiahlee 6y ago
https://news.ycombinator.com/item?id=23790089 https://news.ycombinator.com/item?id=23790089
lathiat 6y ago
That’s twice in as many months. They may need some better QA here although to be fair it does seem mostly people with an older SDK version based on the comments. But still. I guess they need to cotton onto whatever server side change happened and roll it back. At least this time you can disable the SDK (at least one app developer has a kill switch for the SDK) unlike the last issue that happened during code initialisation you couldn’t skip.
- cesarb 6y ago
  > I guess they need to cotton onto whatever server side change happened and roll it back. "A distributed system is one in which the failure of a computer you didn't even know existed can render your own computer unusable." -- Leslie Lamport, 1987 (https://lamport.azurewebsites.net/pubs/distributed-system.txt https://lamport.azurewebsites.net/pubs/distributed-system.tx...)
- notacoward 6y ago
  > They may need some better QA There's no such thing as QA at Facebook. Really. Developers are supposedly responsible for all testing of their own code, but all of the pressure is to "move fast" so that goes about as well as you'd expect.
  - ceejayoz 6y ago
    I’ve had the same basic bug crop up 3x in the last two years while using the API - posts to Groups with dollar amounts just… fail. “An unknown error occurred.” The first two times it took months to fix. It’s happening again currently, too. Clear there are GAPING holes in their test suites.
  - markmark 6y ago
    Looks like it's going pretty well, Facebook is currently worth 700 billion dollars. Or is that not what you meant?
    - jfb 6y ago
      There are multiple dimensions you can use to measure success. Market capitalization is certainly one of them, but it is at best only tenuously related to engineering quality.
0xy 6y ago
It's fantastic news in that it forces the companies who will undoubtedly lose millions of dollars in revenue from this to evaluate their inclusion of the tracking spyware in their apps.
- zuppy 6y ago
  that's not the only purpose of the SDK, we're using it for social login (login with Facebook).
  - akerro 6y ago
    But it's all or nothing right?
  - RL_Quine 6y ago
    Why load it unless it’s being actively used for authentication?
    - cassianoleal 6y ago
      Well, how do you get consistent tracking then? Obs: I'm being sarcastic but since it's either this or developer laziness, I'm betting on tracking since I always start from the principle that the developers analysed the situation and made an explicit choice.
      - Sephiroth87 6y ago
        Except, you know, when does a developer ever have a choice? You are asked to put the SDK in and you do it...
        zuppy 6y ago
        this, combined with a wrong past technical decision that we can not change it instantly. unfortunately it's not as easy to fix mobile bugs as it is on the web, as you have to both pass the approval process and wait for the full rollout to clients. in our case, it's just a wrong decision, we don't use it for tracking. also, if you use facebook login, the terms and conditions force you to use their SDK (which automatically initialises when included and does this crap). https://developers.facebook.com/policy/ https://developers.facebook.com/policy/ - 8.2 "Native iOS and Android apps that implement Facebook Login must use our official SDKs for login. "
phlhar 6y ago
Wow first I thought it was the same thread from a few weeks ago. But that this is happening again is crazy!
rock_artist 6y ago
Argh. Waze, Viber, Gett. It started yesterday on my wife’s phone and today I see it across more devices.
- Nextgrid 6y ago
  It would be nice to have a complete list of apps that include this spyware so we can avoid them.
  - yreg 6y ago
    Or you can block the DNS to be sure. facebook.com fbcdn.com fbcdn.net fbsbx.com fb.com instagram.com
    - Nextgrid 6y ago
      I already do that, but it's good to still know which companies intentionally distribute malware so you can avoid giving money to them.
zuppy 6y ago
I've been fighting with this for an hour. what the heck Facebook guys, you have a responsibility to not break the apps that use your SDK... You can move fast and break you own things.
tqkxzugoaupvwqr 6y ago
I like how “Move fast and break things” still seems to be the mantra at Facebook, undeterred from any breakage in the past.
ChrisMarshallNY 6y ago
<facepalm count="2" /> Not again...
- bootloop 6y ago
  First I thought this is a repost...
jeremiahlee 6y ago
It's also crashing Deezer, but sadly few care.
- afkqs 6y ago
  I do :) I'm not sure if this is a workaround or it got fixed already but I managed to avoid the crash by quickly tapping on another tab on startup
deleted 6y ago
[deleted]
baxtr 6y ago
I recently learned that you need the FB SDK in your iOS app if you want to promote it on FB or Insta. So I guess most apps doing social marketing have the SDK.
- chancemehmu 6y ago
  This is not true.
  - potench 6y ago
    Are you sure? Seem to recall needing FB SDK to manage marketing pixels that provide detail on marketing campaign analytics. If you’re spending money on those platforms to drive traffic you’re going to want to optimize your spend and see performance. To do that I believe you need the FB sdk - are you saying there’s an alternative or are you saying “just don’t optimize performance”.
    - Nextgrid 6y ago
      Can't you optimize ad performance by generating unique URLs for each campaign and then counting the number of clicks/installs per campaign on your own infrastructure?
      - Schiendelman 6y ago
        “Can” is true but not the question at hand! If Facebook, which charges money for advertising, let go of controlling that tracking relationship, they’d lose a lot of money. So they won’t.
        Nextgrid 6y ago
        Doesn't Facebook charge you for clicks regardless? Given the SDK is open-source and is embedded in an app controlled by the developer, there's nothing preventing them from modifying the SDK to report false clicks if Facebook actually relied on the SDK to report ad metrics for billing purposes.
alexhwoods 6y ago
Move fast and break things guys
- SwiftyBug 6y ago
  Break other people's things it seems.
  - radisb 6y ago
    And that's exactly the problem. We give them our things
salzig 6y ago
haha, my girlfriend just wrote me that her spotify stoped working on her mobile. Thanks, send her the github issue.
yreg 6y ago
Workaround for users: Enable airplane mode and disable WiFi, or block facebook domains Workaround for developers: Go to Facebook Developer page > Analytics and disable automatic Events.[0] Apparently this doesn't solve the issue for everyone. Issue in Facebook's tracker: https://developers.facebook.com/status/issues/1739188102911114/ https://developers.facebook.com/status/issues/17391881029111... [0] https://github.com/facebook/facebook-ios-sdk/issues/1427#issuecomment-656635461 https://github.com/facebook/facebook-ios-sdk/issues/1427#iss...
- creaghpatr 6y ago
  Thank you now I can listen to cached Spotify playlists!
- dividedbyzero 6y ago
  Do you know which domains one would need to block?
  - yreg 6y ago
    facebook.com fbcdn.com fbcdn.net fbsbx.com fb.com instagram.com WhatsApp can work without these, but maybe a smaller subset would suffice. NextDNS[0] for iOS can be used for the blocking. [0] https://nextdns.io/ https://nextdns.io/
    - ffpip 6y ago
      connect.facebook.net graph.faceboom.com sdk.facebook.com
    - funmi 6y ago
      Excellent, I was looking for this, thank you! Spotify launched on my iPhone immediately after I added these domains to my NextDNS denylist.
    - washicalendar 6y ago
      What if I want to keep using Messages app (I know I know, but I can’t avoid it)
andersco 6y ago
How is it that a third party SDK is consistently causing apps to completely crash rather than, for example, displaying an error message? Is this a failure that cannot be caught? Sorry, just trying to understand. The dependency relationship just seems to be extreme.
- nicoburns 6y ago
  I believe last time this happened it was because they were running code (including network requests) in a callback that gets called when they were loaded by the dynamic linker.
- yreg 6y ago
  >To stop crashes from the Facebook SDK, some devs tried commenting out any code that calls Facebook. Nothing worked. >It turns out that by just including the SDK with your app, Facebook runs hidden code on launch. (FBSDKApplicationDelegate.m) [0] https://twitter.com/sandofsky/status/1258288056399847425 https://twitter.com/sandofsky/status/1258288056399847425
  - harryf 6y ago
    ... so if the app including the SDK has permission to access location data, the SDK could be passing that location data to Facebook?
    - layoutIfNeeded 6y ago
      Yes.
    - akmarinov 6y ago
      Not only could it do that, but it also totally does do that
      - yreg 6y ago
        Didn't they also use to home in information about surrounding bluetooth devices? When iOS 13 beta dropped, half of the apps suddenly asked for bluetooth permissions because Google/FB SDKs attempted to use it on app launch.
krtkush 6y ago
Given how protective Apple is about the experience of apps on the App Store and this happening the second time, I'm surprised they have not come up with a way to prevent this from happening. Also, a monolithic SDK should not exist in this day and age.
- lowwave 6y ago
  Libs over SDK!
- tannhaeuser 6y ago
  Indeed, and if the FB SDK (as used by the Spotify app among others) does in fact call home, it might violate Apple's TOS and give rise to rejecting those apps on the App Store. I'm not up to date with Apple's policies, but wasn't Apple specifically rejecting apps that seek to establish a platform within Apple's platform? Now if Apple are going to play hardball on this one is another question alltogether.
  - delfinom 6y ago
    It's a money game and Apple could totally crack down it, but they won't. They may long term but they take cowardly slow steps like everyone else does.
    - scarface74 6y ago
      So exactly how much money does Apple make from free apps? If Apple wanted to make money , it should make it harder for advertising supported apps to make money and force apps to either not exist or get people to pay for them. I would be okay with that.
      - tannhaeuser 6y ago
        I guess Apple will have to weigh whether they'll want to tolerate the Fb app on iOS, but more probably they have a deal with Fb (else they would've kicked them out already). Considering Fb is said to be the main portal for "the web" as a Fb user might see it (which I find still very hard to believe for a number of reasons), if the Fb app (or worse, WhatsApp) isn't on iOS, with Safari and FF already blocking most tracking on facebook.com, Fb might block Apple devices altogether, and Apple might or might not stand to loose in device sales, depending on the intersection of Apple's with Fb's target demographic. If it were only for Spotify (which is a direct competitor to Apple Music), they'll have to weigh whether them kicking Spotify out will be seen as anti-competitive vs having a good excuse for eliminating a competitor on their own platform. But maybe my speculations are way off, and Apple will just tell Fb to fix their shit.
michelb 6y ago
Move fast and break other people's things.
pi-err 6y ago
I use a non-Facebook login on Spotify and the app crashes right there. How is this even possible, even less acceptable from Spotify point of view?
- charlesdm 6y ago
  Same here!
- KuiN 6y ago
  It's not acceptable. None of the apps broken on my phone require Facebook features for core functionality. Downtime happens, but downtime due to your non-essential & user-hostile ads/tracking/social SDK? These companies deserve every single cent of lost revenue.
  - zuppy 6y ago
    the sdk initialises itself just by being included. this is why the crash happens on startup. even if you only use it for login, it will still crash.
  - lukeramsden 6y ago
    If the last time this happens is anything to go by, a lot of apps have the FBSDK to facilitate their "Log In with Facebook" functionality. The issue is that you have to include a monolithic SDK that initialises itself without your control just for simple functionality like that. IMO, blame Facebook.
    - swagonomixxx 6y ago
      Blame both of them. I'm done with Spotify after this. I'm heading over to Apple Music. It's a total joke that an app would crash on startup because of this idiocy.
- vini 6y ago
  even my bank app won’t open (Nubank)
G4BB3R 6y ago
Would a type safe language solve this kind of crash? What caused it?
- akmarinov 6y ago
  Seems like they’re no longer returning a string that older sdks expect and they haven’t handled the case properly back then. The crash is: Crash information -[NSNull count]: unrecognized selector sent to instance 0x1cd6fe1e0 2020-07-10 17:24:26.052924+0800 OSDemo[4198:604792] * Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '-[NSNull count]: unrecognized selector sent to instance 0x1cd6fe1e0'
rvz 6y ago
The risk of crashes increase the more third-party SDKs you include. Especially if they use an external service or API which is the case here.
- layoutIfNeeded 6y ago
  * Especially if the 3rd party SDK contacts the external service on launch without any user interaction.
subhajeet2107 6y ago
This is also crashing PUBG Mobile and a lot of gamers are angry as a big tournament (PMWL) is going to start soon, Facebook needs a better QA process
gherkinnn 6y ago
Ah, explains Strava crashing. Mild inconvenience for now, hopefully this will have more people move away from the FB SDK.
deleted 6y ago
[deleted]
scottmf 6y ago
Seems to me like Apple needs to intervene here. Even ignoring the privacy concerns, this is unjustifiable.
- s_dev 6y ago
  Current position of Apple is if you're going to include the FBSDK Sign-In you have to include the Apple Sign-In button too. Removing FBSDK is also acceptable to Apple. So Apple have put out an incentive to their third party Devs while still giving some freedom.
  - scottmf 6y ago
    Apple needs to promote a simple solution to switch your Spotify/whatever account from FB login to the privacy-focused Apple login. Obviously it would require app developers to implement, but Apple has a lot of power here.
    - philo23 6y ago
      This is sort of already a feature coming to iOS 14, though it's really for switching an existing account to an Apple ID login, there's nothing technically stopping a developer from using it to switch a user from FB login connected account too.
      - scottmf 6y ago
        Oh that’s great, thank you. Hopefully Apple will take it a step further somehow.
    - mvanbaak 6y ago
      If an app provides 'login with <something>' the app now has to support 'login with apple' as well. They are not activly blocking apps that violate this rule, but soon they will.
    - rideontime 6y ago
      In our app we've already added a "Link your Apple ID" option to add Sign In With Apple to an existing account, it's easy enough to implement without any official support from Apple.
jgeada 6y ago
Can confirm that blocking Facebook on my iPhone makes these crashes go away. All in all I might leave that block up permanently as nothing going to those addresses does me any good
- afroisalreadyin 6y ago
  How do you do that? At OS level with a setting? Networking changes?
  - jgeada 6y ago
    I use an app called AdBlock https://apps.apple.com/app/apple-store/id691121579?pt=425087&ct=in-app-share&mt=8 https://apps.apple.com/app/apple-store/id691121579?pt=425087... It creates a local VPN that sets up a local filtering DNS. I just added the following domains to the block list: facebook.com fbcdn.com fbcdn.net fbsbx.com fb.com
    - riyadparvez 6y ago
      That's very interesting. Does Android have anything similar?
      - leokennis 6y ago
        Not sure, but you can use something like NextDNS to achieve the same. It’s basically a “pihole in the cloud”: https://kennis.cc/public_uploads/0caeb8d4.png https://kennis.cc/public_uploads/0caeb8d4.png
      - ffpip 6y ago
        Android has tons of these apps. Cuz its Android. An app exists for everything. Check out Blockada. (Non-root) Adaway (root and non root phones) Adaway requires version 5.something for non rooted devices. Anything less than version 4 is only for rooted devices.
      - Ianvdl 6y ago
slackbob334 6y ago
Is this why Spotify is crashing AGAIN? WTF Facebook.
Karupan 6y ago
How is Apple not addressing this? This seems like a pretty glaring hole in their tightly controlled environment. If the SDK is injecting code, shouldn’t that be an explicit permission?
- pjc50 6y ago
  It's "inside" the application and the code is injected at build time, by the sounds of it.
  - Karupan 6y ago
    Thanks for clearing that up. I wonder if developers actually know they are signing up for this when blindly dropping in the SDK, just to support FB login. I’m surprised most popular apps haven’t learnt their lesson since this happened last month as well.
- kerbs 6y ago
  I mean what would they do?
  - scottmf 6y ago
    Heavy restrictions on how apps use third party SDKs for signing in, forcing FB to change its policy of requiring the SDK for native apps which use FB to sign in. And then reject new app updates which don’t follow the new rules. Or just outright ban this spyware.
    - scarface74 6y ago
      Yes because government officials know enough about technology to pass those types of laws.
      - scottmf 6y ago
        I’m talking about Apple.
beagle3 6y ago
Waze, a google owned app for the past 4 years, crashes because of the FB app. WhatsApp, a Facebook owned app, will not give you read access to your own chat database - it’s encrypted. But they have an arrangement with Google where it’s will back up unencrypted to your Google account (though, Google won’t let you retrieve it ... only the WhatsApp app can) Everything about this duopoly, their cooperation and lack of competition stinks to high heaven.
- AlexandrB 6y ago
  > WhatsApp, a Facebook owned app, will not give you read access to your own chat database - it’s encrypted. On android? On iOS you can get a tarball of all your chats.
  - alias_neo 6y ago
    I just had to check this; the Android app has "Request account info" and specifically mentions "which you can access or port to another app". As much as I'm happy to pile on Google, Facebook and WhatsApp, this appears to be untrue.
    - soziawa 6y ago
      That is just what WhatsApp stores about you on their servers i.e. contacts and groups. But you can export all chats one by one.
    - beagle3 6y ago
      It also specifically mentions that doesn't contain all the messages, and takes up to 3 days. You can export individual chats as texts, but not all the attachments, metadata, etc - and you have to specifically select each one. The statement that "Facebook gives an unencrypted copy of your chat database to Google but will not give it to you" is true; I'm referring to the SQLite database. You can back it up locally, but it's encrypted and Facebook will not willingly give you the key under any circumstance (though it is possible to trick them by impersonating the app). However, the Google Drive backup is unencrypted. But Google won't let you download it directly either (although, again, you can trick them by impersonating the app).
layoutIfNeeded 6y ago
Apple should ban these SDKs, period. If a third-party entity fucking up their backend can bring down the whole ecosystem then they've lost control over iOS.
AlexandrB 6y ago
What iOS desperately needs is a client side firewall like little snitch. It would be an easy workaround for this nonsense - with additional privacy benefits. Plus, if every time Facebook fucked up a portion of users started blocking facebook URLs they might QA a little bit more thoroughly.
polack 6y ago
Feels fair that it's happening to companies that hand over our data to third parties. Anything that can open the general public's eyes to how much data is leaked through these kind of practices is a good thing. Hope it amounts to some non-negligible loss for Facebook, Spotify and the others.
Austin_Conlon 6y ago
They never responded to my request for a postmortem on the previous blunder: https://github.com/facebook/facebook-ios-sdk/issues/1385 https://github.com/facebook/facebook-ios-sdk/issues/1385.
- NAR8789 6y ago
  Anyone reading this, please make some noise that request for postmortem. https://github.com/facebook/facebook-ios-sdk/issues/1385 https://github.com/facebook/facebook-ios-sdk/issues/1385 I want a central document with clear steps on how to mitigate. Currently the best option for documentation seems to be wading through comment threads, which is very frustrating.
- booleanbetrayal 6y ago
  Maybe if Facebook were actually required to provide post-mortems, the developers would be more cautious about creating these outages in the first place. One thing's for certain, the silence is infuriating.
  - delecti 6y ago
    Being "required" to provide post-mortems doesn't always mean they will actually do it.
peteretep 6y ago
I fucking hate that Spotify uses this.
- Schiendelman 6y ago
  Use Apple Music!
  - pferde 6y ago
    Or just keep your music collection local and laugh in disbelief at these Black Mirror-esque problems. The simple act of listening to music should not require a vast server infrastructure at the other end of the world, under control of a third party, and a working global communications network. The fact that people got used to this kind of nonsense is very, very scary to me.
    - duval 6y ago
      What is so scary about there being a market for a flat fee service allowing you to listen to any song you want, any time you want? The act of listening to music doesnt require a vast server infrastructure. Thats why people could still listen to music they had stored offline during the outage.
  - valuearb 6y ago
    Apple Music doesn't work most of time, that's why I switched to Spotify.
    - theshrike79 6y ago
      How can a music app "not work"?
      - valuearb 6y ago
        Refuses to play unless restarted. Every single day. Forgets selected play list from previous day. Every single day. Sometimes would play to wrong audio output, which would produce the same silence as first problem but restarting/ rebooting wouldn’t fix. Finally I’d realize and switch it back in control panel.
rimliu 6y ago
I cannot take anything Facebook does (at least on iOS) seriously since the day they were bragging (with straight faces) about having so many classes that Xcode could not cope with them. And IIRC, lots of them were auto-generated and never pruned.
Google234 6y ago
This seems insane to me. Who rolled out this change? Why can’t they just roll it back
heavenlyblue 6y ago
Spotify is the same for me today
bernardlunn 6y ago
Memo to dev team - pay attention to tech stack risk
adamparsons 6y ago
My personal anecdote: I’m parked over on the side of the road because my carplay habits of Spotify and Waze both kept crashing to the dashboard. I couldn’t help but notice neither app worked even after a reboot, yet google maps did. I was thinking there was a carplay bug and then thought: “oh boy here we go, what are the odds, let’s check hackernews” and bam, of course it’s the Facebook sdk again I’m thankful that googles iOS-chrome and google maps doesn’t use the Facebook sdk for something...
drcongo 6y ago
None of the apps on my phone are crashing because of this. I also don't have a Facebook account, nor do I have the Facebook app installed. So it looks like there's an easy fix, delete your account, delete Facebook.
- didntlogin 6y ago
  The issue got resolved 5 minutes ago.
  - drcongo 6y ago
    And everything was already working for me fine before that. Admittedly I do also have every Facebook domain blocked through NextDNS.
bloemy 6y ago
Seems like it's just been fixed again. All apps are working.
bloemy 6y ago
Seems like it's been fixed just now. All apps are working again.
- Reason077 6y ago
  Yes, Spotify appears to have been hotfixed at least. Was 100% crashing for me earlier this morning. Working fine now.
lyjackal 6y ago
Top Google trending search suggestion on my phone right now: "iphone spotify app keeps crashing"
numpad0 6y ago
For end users who need affected apps right now: 1) Download NextDNS from App Store 2) Open app. Hit (...) 3) Enable Custom Configuration, Config ID 22776a It’ll DNS block some ads and Facebook domains. Turn off after you’re done. Also assume any DNS server offered by random dude as poisoned. Edit: Issue resolved! People, turn it off or switch to your own configuration.
Jakob 6y ago
You can disable the Facebook SDK phoning home: https://developers.facebook.com/docs/app-events/gdpr-compliance https://developers.facebook.com/docs/app-events/gdpr-complia... Any idea why seemingly no one of the big apps does this?
radisb 6y ago
Not to sound as old or anachronistic but I kind of watch this stuff happening and wonder when all those useless bubbly conveniences are going to burst. Never had any account on facebook, twitter, instagram, viber, whatsapp etc. Last similar stuff i used was IRC and ICQ. Some Messenger and skype but i abandoned those long ago. Now I only use discord when I am gaming or wanna talk to a friend and I am sitting in my desk. Mobile phones were a big step forward from plain old landline ones. But in terms of ease of communication this change was the last one with non-deminishing returns. Maybe smart phones also just for browsing HN when I wait in a queue or in the bus etc. All those social networking and communication apps? Fcuk them. I can perfectly communicate by calling or texting or video calling someone. What exactly is the added value of those apps?
- valuearb 6y ago
  If you are Spotify, it provided a seamless experience for millions of people to sign up for their service. Now they have a lockin problem, and need to figure out how to migrate those accounts to another authentication service. And for Communication, you never use Slack? It's useful to segment your communications by type, I don't want to give random Tinder ladies my home phone number.
  - radisb 6y ago
    I don’t use tinder. I don’t use slack
deleted 6y ago
[deleted]
sjg007 6y ago
I've noticed FB crashing as well.
marinosbern 6y ago
While Spotify crashing on launch may be a nuisance, this also affects life-critical apps crashing on launch. Our forensic analysis [1] found that half of the top 21 iOS safety apps send data to Facebook, and last time this happened back in May we spot-checked some of these safety apps and they were all crashing on launch. The SDK is typically included for ad attribution/tracking, not Facebook login, so it wouldn’t even be visible to the end user, and there’s no way to disable it. [1] https://parachute.live/blog/forensic-investigation-the-shocking-state-of-privacy-in-safety-apps https://parachute.live/blog/forensic-investigation-the-shock...
- letitbeirie 6y ago
  I've installed dozens of life-safety-critical services and none of them had ads or the Facebook SDK for very good reasons. AMA.
  - marinosbern 6y ago
    > I've installed dozens of life-safety-critical services and none of them had ads or the Facebook SDK Can you give a few examples? > none of them had ads The comment was about the Facebook SDK being used for ad attribution, not that the apps themselves have ads.
- swagonomixxx 6y ago
  I'm sorry, but if someone is building a life-critical app and using Facebook, just, why? Do they want to tell FB about all your critical conditions too?
pluc 6y ago
Couldn't Find Advertisers
cpv 6y ago
Is this a Deja Vu https://news.ycombinator.com/item?id=23097459 https://news.ycombinator.com/item?id=23097459 ?
justinclift 6y ago
Wonder if it was due to an expired or revoked certificate? Maybe the mass revocation of EV certs happening ~today is the trigger?
- bolmaster2 6y ago
  Who is revoking EV certs today?
  - justinclift 6y ago
    https://www.theregister.com/2020/07/10/digicert_pulls_certs/ https://www.theregister.com/2020/07/10/digicert_pulls_certs/
Hamuko 6y ago
I actually went to the post office today (couple of hours ago) and tried to use the national postal carrier's app to get my pickup code. The application just kept crashing. I showed it to the man at the counter and he said that others had had the same issue, although he didn't specify if it was earlier the same day or way back. I wonder if it was the same issue.
dathinab 6y ago
That is now the how manyth time this happened? Like wtf. they have so many resources how is it possible that even with that they can't make their sdk error resilient.
bschwindHN 6y ago
Stop using facebook's garbage! Or if you must, use their oauth flow and API but _don't_ include code of theirs you don't control directly in your binary. It's just asking for trouble. https://news.ycombinator.com/item?id=23099788 https://news.ycombinator.com/item?id=23099788
- scottmf 6y ago
  And then FB will ban your app.
  - swagonomixxx 6y ago
    Ban it from where? Using their API?
    - zedpm 6y ago
      Yes, Facebook requires that any mobile app using Facebook login do so via their SDK. Presumably they will disable your Facebook app (breaking login) if you don’t comply.
      - lucasar 6y ago
        The above is correct. Facebook wants you to use the SDK.
      - tdrp 6y ago
        They told us that explicitly. We had been using the URL-based login on the app (i.e. open a browser with the URL and use the redirect to continue logging in), for almost two years. Then about a year ago, they e-mailed us just before a holiday and told us we had less than a week to move all of our apps to SDK otherwise they'd just disable us. Their argument was that "it's not providing the best possible experience to our users". There hadn't been a single complaint about it though. We had nearly 100,000 users logged into our app via Facebook login so we were basically strongarmed into complying. We somehow pulled it off before the deadline for both Android and iOS but felt really dirty afterwards.
dr-detroit 6y ago
Zuckerberg's monthy CIA funding cheque probably bounced
zacwest 6y ago
Apple's refusal to support XPC and the ability for apps to launch secondary processes is the real underlying issue here. Being able to separate out execution and process permissions from the main app solves a ton of third-party SDK issues as well as just normal "why is my app crashing because of decoding?"-style issues.
- Spooky23 6y ago
  Sure, I really want multiple crashing Facebook spy processes crashing on my phone continuously.
Tepix 6y ago
The DJI Fly app is also affected. Workaround: Start it in flight mode.
emerongi 6y ago
The most popular apps on one of the most popular operating systems just plainly don't even open. What has this industry become? How are we so goddamn inept at writing software? This is an industry where we can automate testing - not many other industries have this capability - and we still don't have a simple test regime of "check if the app opens" for any of those apps. Somehow, at the most valuable software companies of the world, nobody has set up a system that makes sure that you can't introduce a change that renders these apps unusable? WHAT THE FUCK. I have always been afraid of software engineering becoming a trade similar to medicine or law or (regular) engineering where significant barriers will be put up before you can enter the industry, but this sort of shit makes me feel like it could be for the better. I will have to go and get a degree, but that's the price I have to pay I guess.
- rachelbythebay 6y ago
  Years ago, I had one of the employee builds on my company phone, and it picked up an update and would "instacrash" - tap the icon, and it'd die immediately. Crash. Crash. Crash. A couple of days later I caught up with the people allegedly responsible for this stuff in the bigger review meeting. "Shouldn't you open a SEV because you are shipping stuff that can't possibly work and aren't catching it pre-release?" The response was a lot of hand-waving and stupid manager-speak that boiled down to "no, go away". I basically wrote them off at that point. If they could act that way and get away with it by way of implicit acceptance from upper management, that's just the way it was going to be. I see the quality is as high as always.
  - exikyut 6y ago
    Curiously, this type of handwavy response reveals a not-quite-1:1 mapping between the sort of assertive, pro-admission, fail-forward balance that "move fast, break things" implies for me, and the apparent reality which seems closer to "haha crowdsourced QC go brrrrt" :(
  - fsociety 6y ago
    Yep at such a large company there is such huge variance in quality. Wish you and many others were still here to help fight against this mindset. There is lots of high quality work done here, but it doesn’t matter if we end up with issues like this.
have_faith 6y ago
I was wondering why spotify wouldn't open earlier today. Updating it didn't help. And then later on it randomly started working again.
connorlwilkes 6y ago
The same kind of thing happened today with Spotify's application on iOS and this also happened about a month ago too. I am surprised that regression testing tools aren't picking up these issues before they push these updates out to user's devices
iamspoilt 6y ago
Oh is this why I couldn't play anything on Spotify during my morning run as it kept crashing! Had to play Apple Music's Beats 1 radio instead.
occamschainsaw 6y ago
I installed iOS 14 beta today and got mad at Apple because I thought the update broke so many apps on my phone. Turns out it was FB sdk coincidentally. One more reason to be mad at FB.
- sigwinch28 6y ago
  Same thing happened here. Spotify wouldn't open and I thought "oh no, I need to downgrade to listen to music via Spotify." Someone recommended airplane mode and lo and behold the app started working. This is Facebook's fault, but also Spotify's. How such an established platform with supposedly-established engineers can let a third party library crash their app at startup is genuinely embarrassing.
speedyapoc 6y ago
Issue seems to be resolved, but the the comment on their bug tracker is almost infuriating. “ Earlier today, a code change triggered crashes for some iOS apps using the Facebook SDK. We identified the issue quickly and resolved it. We apologize for any inconvenience.” (1) At the scale of Spotify and other massive blue chip apps, this bug could have very well cost companies hundreds of thousands to millions of dollars in damages. This apology on the bug tracker seems so insincere. With this type of issue occurring twice in a couple months, I’ll be ensuring that no clients of mine ever install or rely on Facebook services within their mobile apps. Facebook has a responsibility to developers to ensure that their SDKs and integrated components are stable, and they have failed. [1] https://developers.facebook.com/status/issues/1739188102911114/ https://developers.facebook.com/status/issues/17391881029111...
- sigwinch28 6y ago
  Assuming that developers of these apps get the same license we plebs get (i.e. NO WARRANTY), then I see very little recourse. Facebook are big enough to blow this off, and they know it. At least... they hope so.
johnvega 6y ago
Seems like FB way of forcing devs to use the latest SDK, unless FB shares technical details on what happened. This is what FB for dev says: "To make your app compatible with the latest iOS, be sure to use the latest Facebook SDKs for iOS." https://developers.facebook.com/docs/ios https://developers.facebook.com/docs/ios
barryrandall 6y ago
I'm looking forward to these future HN posts: "Increase iOS app reliability with this simple trick", "How I Increased retention 10x by canceling Facebook", and "Most popular app in world yanked for privacy violations"
sphix0r 6y ago
Insane. Good to know what made my Spotify app crash upon startup though.
lucasar 6y ago
It is evident that Facebook does not QA the way they should. It would be nice if Apple added mechanisms that allow a dependency in an app to crash but allow the host app to continue to run regardless.
nradov 6y ago
Apparently the Strava app is also impacted, and probably others as well.
cryptozeus 6y ago
I have switched to FB web version and uninstalled the app, this has worked very well for me. Its less engaging and I get to keep in touch with my family.
hnick 6y ago
I greatly appreciate the candid snark in the bug report. Sometimes there's just not much more to say.
jmspring 6y ago
The removal of FB and Google from my digital life are my goals for the next year/. Where I need FB (groups) it’ll be a fake account through a vpn/etc
neop1x 6y ago
Of course FB SDK could work only after a user requests its functionality by tapping or logging in. But no... they need to harvest analytics and track users as they do ad-business primarily... :(

596 points by reubensutton 6y ago

beshrkayali 6y ago

How/why does Spotify app use Facebook iOS SDK?

lewisj489 6y ago
You can share what you're listening to on Facebook "Lewisj489 is listening to Band on Spotify"
johannes1234321 6y ago
You can login to Spotify via Facebook as you can see in the web version: https://accounts.spotify.com/en/login/ https://accounts.spotify.com/en/login/ For doing that in a app they require the SDK, which then does all the spying for Facebook.
- dictum 6y ago
  Why is the Facebook integration not lazy-loaded only for users who log in through an FB account?
  - johannes1234321 6y ago
    Because FB doesn't support that. Either you build it in and it runs some code when your app starts or you can't use it. I would vote for "not use it" but others want Facebook integration supported and happily share information on all their users to Facebook ... P.S. I believe part of this is also Apple, who don't like runtime loading of code, as that makes their verification harder, but I'm no iOS dev or user.
- deleted 6y ago
  [deleted]
deleted 6y ago
[deleted]

jasonlingx 6y ago

> FB, Have you consider adding Continuous Integration and Functional Tests questions to your Interview's questionnaire? :)

docdeek 6y ago

I don’t use Facebook or Spotify but it seems the people who coded the NYT Crossword app do - crashing for the last hour or more. Frustrating...

jeremiahlee 6y ago

https://news.ycombinator.com/item?id=23790089 https://news.ycombinator.com/item?id=23790089

lathiat 6y ago

That’s twice in as many months. They may need some better QA here although to be fair it does seem mostly people with an older SDK version based on the comments. But still. I guess they need to cotton onto whatever server side change happened and roll it back. At least this time you can disable the SDK (at least one app developer has a kill switch for the SDK) unlike the last issue that happened during code initialisation you couldn’t skip.

cesarb 6y ago
> I guess they need to cotton onto whatever server side change happened and roll it back. "A distributed system is one in which the failure of a computer you didn't even know existed can render your own computer unusable." -- Leslie Lamport, 1987 (https://lamport.azurewebsites.net/pubs/distributed-system.txt https://lamport.azurewebsites.net/pubs/distributed-system.tx...)
notacoward 6y ago
> They may need some better QA There's no such thing as QA at Facebook. Really. Developers are supposedly responsible for all testing of their own code, but all of the pressure is to "move fast" so that goes about as well as you'd expect.
- ceejayoz 6y ago
  I’ve had the same basic bug crop up 3x in the last two years while using the API - posts to Groups with dollar amounts just… fail. “An unknown error occurred.” The first two times it took months to fix. It’s happening again currently, too. Clear there are GAPING holes in their test suites.
- markmark 6y ago
  Looks like it's going pretty well, Facebook is currently worth 700 billion dollars. Or is that not what you meant?
  - jfb 6y ago
    There are multiple dimensions you can use to measure success. Market capitalization is certainly one of them, but it is at best only tenuously related to engineering quality.

0xy 6y ago

It's fantastic news in that it forces the companies who will undoubtedly lose millions of dollars in revenue from this to evaluate their inclusion of the tracking spyware in their apps.

zuppy 6y ago
that's not the only purpose of the SDK, we're using it for social login (login with Facebook).
- akerro 6y ago
  But it's all or nothing right?
- RL_Quine 6y ago
  Why load it unless it’s being actively used for authentication?
  - cassianoleal 6y ago
    Well, how do you get consistent tracking then? Obs: I'm being sarcastic but since it's either this or developer laziness, I'm betting on tracking since I always start from the principle that the developers analysed the situation and made an explicit choice.
    - Sephiroth87 6y ago
      Except, you know, when does a developer ever have a choice? You are asked to put the SDK in and you do it...
      - zuppy 6y ago
        this, combined with a wrong past technical decision that we can not change it instantly. unfortunately it's not as easy to fix mobile bugs as it is on the web, as you have to both pass the approval process and wait for the full rollout to clients. in our case, it's just a wrong decision, we don't use it for tracking. also, if you use facebook login, the terms and conditions force you to use their SDK (which automatically initialises when included and does this crap). https://developers.facebook.com/policy/ https://developers.facebook.com/policy/ - 8.2 "Native iOS and Android apps that implement Facebook Login must use our official SDKs for login. "

phlhar 6y ago

Wow first I thought it was the same thread from a few weeks ago. But that this is happening again is crazy!

rock_artist 6y ago

Argh. Waze, Viber, Gett. It started yesterday on my wife’s phone and today I see it across more devices.

Nextgrid 6y ago
It would be nice to have a complete list of apps that include this spyware so we can avoid them.
- yreg 6y ago
  Or you can block the DNS to be sure. facebook.com fbcdn.com fbcdn.net fbsbx.com fb.com instagram.com
  - Nextgrid 6y ago
    I already do that, but it's good to still know which companies intentionally distribute malware so you can avoid giving money to them.

zuppy 6y ago

I've been fighting with this for an hour. what the heck Facebook guys, you have a responsibility to not break the apps that use your SDK... You can move fast and break you own things.

tqkxzugoaupvwqr 6y ago

I like how “Move fast and break things” still seems to be the mantra at Facebook, undeterred from any breakage in the past.

ChrisMarshallNY 6y ago

<facepalm count="2" /> Not again...

bootloop 6y ago
First I thought this is a repost...

jeremiahlee 6y ago

It's also crashing Deezer, but sadly few care.

afkqs 6y ago
I do :) I'm not sure if this is a workaround or it got fixed already but I managed to avoid the crash by quickly tapping on another tab on startup

deleted 6y ago

[deleted]

baxtr 6y ago

I recently learned that you need the FB SDK in your iOS app if you want to promote it on FB or Insta. So I guess most apps doing social marketing have the SDK.

chancemehmu 6y ago
This is not true.
- potench 6y ago
  Are you sure? Seem to recall needing FB SDK to manage marketing pixels that provide detail on marketing campaign analytics. If you’re spending money on those platforms to drive traffic you’re going to want to optimize your spend and see performance. To do that I believe you need the FB sdk - are you saying there’s an alternative or are you saying “just don’t optimize performance”.
  - Nextgrid 6y ago
    Can't you optimize ad performance by generating unique URLs for each campaign and then counting the number of clicks/installs per campaign on your own infrastructure?
    - Schiendelman 6y ago
      “Can” is true but not the question at hand! If Facebook, which charges money for advertising, let go of controlling that tracking relationship, they’d lose a lot of money. So they won’t.
      - Nextgrid 6y ago
        Doesn't Facebook charge you for clicks regardless? Given the SDK is open-source and is embedded in an app controlled by the developer, there's nothing preventing them from modifying the SDK to report false clicks if Facebook actually relied on the SDK to report ad metrics for billing purposes.

alexhwoods 6y ago

Move fast and break things guys

SwiftyBug 6y ago
Break other people's things it seems.
- radisb 6y ago
  And that's exactly the problem. We give them our things

salzig 6y ago

haha, my girlfriend just wrote me that her spotify stoped working on her mobile. Thanks, send her the github issue.

yreg 6y ago

Workaround for users: Enable airplane mode and disable WiFi, or block facebook domains Workaround for developers: Go to Facebook Developer page > Analytics and disable automatic Events.[0] Apparently this doesn't solve the issue for everyone. Issue in Facebook's tracker: https://developers.facebook.com/status/issues/1739188102911114/ https://developers.facebook.com/status/issues/17391881029111... [0] https://github.com/facebook/facebook-ios-sdk/issues/1427#issuecomment-656635461 https://github.com/facebook/facebook-ios-sdk/issues/1427#iss...

creaghpatr 6y ago
Thank you now I can listen to cached Spotify playlists!
dividedbyzero 6y ago
Do you know which domains one would need to block?
- yreg 6y ago
  facebook.com fbcdn.com fbcdn.net fbsbx.com fb.com instagram.com WhatsApp can work without these, but maybe a smaller subset would suffice. NextDNS[0] for iOS can be used for the blocking. [0] https://nextdns.io/ https://nextdns.io/
  - ffpip 6y ago
    connect.facebook.net graph.faceboom.com sdk.facebook.com
  - funmi 6y ago
    Excellent, I was looking for this, thank you! Spotify launched on my iPhone immediately after I added these domains to my NextDNS denylist.
  - washicalendar 6y ago
    What if I want to keep using Messages app (I know I know, but I can’t avoid it)

andersco 6y ago

How is it that a third party SDK is consistently causing apps to completely crash rather than, for example, displaying an error message? Is this a failure that cannot be caught? Sorry, just trying to understand. The dependency relationship just seems to be extreme.

nicoburns 6y ago
I believe last time this happened it was because they were running code (including network requests) in a callback that gets called when they were loaded by the dynamic linker.
yreg 6y ago
>To stop crashes from the Facebook SDK, some devs tried commenting out any code that calls Facebook. Nothing worked. >It turns out that by just including the SDK with your app, Facebook runs hidden code on launch. (FBSDKApplicationDelegate.m) [0] https://twitter.com/sandofsky/status/1258288056399847425 https://twitter.com/sandofsky/status/1258288056399847425
- harryf 6y ago
  ... so if the app including the SDK has permission to access location data, the SDK could be passing that location data to Facebook?
  - layoutIfNeeded 6y ago
    Yes.
  - akmarinov 6y ago
    Not only could it do that, but it also totally does do that
    - yreg 6y ago
      Didn't they also use to home in information about surrounding bluetooth devices? When iOS 13 beta dropped, half of the apps suddenly asked for bluetooth permissions because Google/FB SDKs attempted to use it on app launch.

krtkush 6y ago

Given how protective Apple is about the experience of apps on the App Store and this happening the second time, I'm surprised they have not come up with a way to prevent this from happening. Also, a monolithic SDK should not exist in this day and age.

lowwave 6y ago
Libs over SDK!
tannhaeuser 6y ago
Indeed, and if the FB SDK (as used by the Spotify app among others) does in fact call home, it might violate Apple's TOS and give rise to rejecting those apps on the App Store. I'm not up to date with Apple's policies, but wasn't Apple specifically rejecting apps that seek to establish a platform within Apple's platform? Now if Apple are going to play hardball on this one is another question alltogether.
- delfinom 6y ago
  It's a money game and Apple could totally crack down it, but they won't. They may long term but they take cowardly slow steps like everyone else does.
  - scarface74 6y ago
    So exactly how much money does Apple make from free apps? If Apple wanted to make money , it should make it harder for advertising supported apps to make money and force apps to either not exist or get people to pay for them. I would be okay with that.
    - tannhaeuser 6y ago
      I guess Apple will have to weigh whether they'll want to tolerate the Fb app on iOS, but more probably they have a deal with Fb (else they would've kicked them out already). Considering Fb is said to be the main portal for "the web" as a Fb user might see it (which I find still very hard to believe for a number of reasons), if the Fb app (or worse, WhatsApp) isn't on iOS, with Safari and FF already blocking most tracking on facebook.com, Fb might block Apple devices altogether, and Apple might or might not stand to loose in device sales, depending on the intersection of Apple's with Fb's target demographic. If it were only for Spotify (which is a direct competitor to Apple Music), they'll have to weigh whether them kicking Spotify out will be seen as anti-competitive vs having a good excuse for eliminating a competitor on their own platform. But maybe my speculations are way off, and Apple will just tell Fb to fix their shit.

michelb 6y ago

Move fast and break other people's things.

pi-err 6y ago

I use a non-Facebook login on Spotify and the app crashes right there. How is this even possible, even less acceptable from Spotify point of view?

charlesdm 6y ago
Same here!
KuiN 6y ago
It's not acceptable. None of the apps broken on my phone require Facebook features for core functionality. Downtime happens, but downtime due to your non-essential & user-hostile ads/tracking/social SDK? These companies deserve every single cent of lost revenue.
- zuppy 6y ago
  the sdk initialises itself just by being included. this is why the crash happens on startup. even if you only use it for login, it will still crash.
- lukeramsden 6y ago
  If the last time this happens is anything to go by, a lot of apps have the FBSDK to facilitate their "Log In with Facebook" functionality. The issue is that you have to include a monolithic SDK that initialises itself without your control just for simple functionality like that. IMO, blame Facebook.
  - swagonomixxx 6y ago
    Blame both of them. I'm done with Spotify after this. I'm heading over to Apple Music. It's a total joke that an app would crash on startup because of this idiocy.
vini 6y ago
even my bank app won’t open (Nubank)

G4BB3R 6y ago

Would a type safe language solve this kind of crash? What caused it?

akmarinov 6y ago
Seems like they’re no longer returning a string that older sdks expect and they haven’t handled the case properly back then. The crash is: Crash information -[NSNull count]: unrecognized selector sent to instance 0x1cd6fe1e0 2020-07-10 17:24:26.052924+0800 OSDemo[4198:604792] * Terminating app due to uncaught exception 'NSInvalidArgumentException', reason: '-[NSNull count]: unrecognized selector sent to instance 0x1cd6fe1e0'

rvz 6y ago

The risk of crashes increase the more third-party SDKs you include. Especially if they use an external service or API which is the case here.

layoutIfNeeded 6y ago
* Especially if the 3rd party SDK contacts the external service on launch without any user interaction.

subhajeet2107 6y ago

This is also crashing PUBG Mobile and a lot of gamers are angry as a big tournament (PMWL) is going to start soon, Facebook needs a better QA process

gherkinnn 6y ago

Ah, explains Strava crashing. Mild inconvenience for now, hopefully this will have more people move away from the FB SDK.

deleted 6y ago

[deleted]

scottmf 6y ago

Seems to me like Apple needs to intervene here. Even ignoring the privacy concerns, this is unjustifiable.

s_dev 6y ago
Current position of Apple is if you're going to include the FBSDK Sign-In you have to include the Apple Sign-In button too. Removing FBSDK is also acceptable to Apple. So Apple have put out an incentive to their third party Devs while still giving some freedom.
- scottmf 6y ago
  Apple needs to promote a simple solution to switch your Spotify/whatever account from FB login to the privacy-focused Apple login. Obviously it would require app developers to implement, but Apple has a lot of power here.
  - philo23 6y ago
    This is sort of already a feature coming to iOS 14, though it's really for switching an existing account to an Apple ID login, there's nothing technically stopping a developer from using it to switch a user from FB login connected account too.
    - scottmf 6y ago
      Oh that’s great, thank you. Hopefully Apple will take it a step further somehow.
  - mvanbaak 6y ago
    If an app provides 'login with <something>' the app now has to support 'login with apple' as well. They are not activly blocking apps that violate this rule, but soon they will.
  - rideontime 6y ago
    In our app we've already added a "Link your Apple ID" option to add Sign In With Apple to an existing account, it's easy enough to implement without any official support from Apple.

jgeada 6y ago

Can confirm that blocking Facebook on my iPhone makes these crashes go away. All in all I might leave that block up permanently as nothing going to those addresses does me any good

afroisalreadyin 6y ago
How do you do that? At OS level with a setting? Networking changes?
- jgeada 6y ago
  I use an app called AdBlock https://apps.apple.com/app/apple-store/id691121579?pt=425087&ct=in-app-share&mt=8 https://apps.apple.com/app/apple-store/id691121579?pt=425087... It creates a local VPN that sets up a local filtering DNS. I just added the following domains to the block list: facebook.com fbcdn.com fbcdn.net fbsbx.com fb.com
  - riyadparvez 6y ago
    That's very interesting. Does Android have anything similar?
    - leokennis 6y ago
      Not sure, but you can use something like NextDNS to achieve the same. It’s basically a “pihole in the cloud”: https://kennis.cc/public_uploads/0caeb8d4.png https://kennis.cc/public_uploads/0caeb8d4.png
    - ffpip 6y ago
      Android has tons of these apps. Cuz its Android. An app exists for everything. Check out Blockada. (Non-root) Adaway (root and non root phones) Adaway requires version 5.something for non rooted devices. Anything less than version 4 is only for rooted devices.
    - Ianvdl 6y ago

slackbob334 6y ago

Is this why Spotify is crashing AGAIN? WTF Facebook.

Karupan 6y ago

How is Apple not addressing this? This seems like a pretty glaring hole in their tightly controlled environment. If the SDK is injecting code, shouldn’t that be an explicit permission?

pjc50 6y ago
It's "inside" the application and the code is injected at build time, by the sounds of it.
- Karupan 6y ago
  Thanks for clearing that up. I wonder if developers actually know they are signing up for this when blindly dropping in the SDK, just to support FB login. I’m surprised most popular apps haven’t learnt their lesson since this happened last month as well.
kerbs 6y ago
I mean what would they do?
- scottmf 6y ago
  Heavy restrictions on how apps use third party SDKs for signing in, forcing FB to change its policy of requiring the SDK for native apps which use FB to sign in. And then reject new app updates which don’t follow the new rules. Or just outright ban this spyware.
  - scarface74 6y ago
    Yes because government officials know enough about technology to pass those types of laws.
    - scottmf 6y ago
      I’m talking about Apple.

beagle3 6y ago

Waze, a google owned app for the past 4 years, crashes because of the FB app. WhatsApp, a Facebook owned app, will not give you read access to your own chat database - it’s encrypted. But they have an arrangement with Google where it’s will back up unencrypted to your Google account (though, Google won’t let you retrieve it ... only the WhatsApp app can) Everything about this duopoly, their cooperation and lack of competition stinks to high heaven.

AlexandrB 6y ago
> WhatsApp, a Facebook owned app, will not give you read access to your own chat database - it’s encrypted. On android? On iOS you can get a tarball of all your chats.
- alias_neo 6y ago
  I just had to check this; the Android app has "Request account info" and specifically mentions "which you can access or port to another app". As much as I'm happy to pile on Google, Facebook and WhatsApp, this appears to be untrue.
  - soziawa 6y ago
    That is just what WhatsApp stores about you on their servers i.e. contacts and groups. But you can export all chats one by one.
  - beagle3 6y ago
    It also specifically mentions that doesn't contain all the messages, and takes up to 3 days. You can export individual chats as texts, but not all the attachments, metadata, etc - and you have to specifically select each one. The statement that "Facebook gives an unencrypted copy of your chat database to Google but will not give it to you" is true; I'm referring to the SQLite database. You can back it up locally, but it's encrypted and Facebook will not willingly give you the key under any circumstance (though it is possible to trick them by impersonating the app). However, the Google Drive backup is unencrypted. But Google won't let you download it directly either (although, again, you can trick them by impersonating the app).

layoutIfNeeded 6y ago

Apple should ban these SDKs, period. If a third-party entity fucking up their backend can bring down the whole ecosystem then they've lost control over iOS.

AlexandrB 6y ago

What iOS desperately needs is a client side firewall like little snitch. It would be an easy workaround for this nonsense - with additional privacy benefits. Plus, if every time Facebook fucked up a portion of users started blocking facebook URLs they might QA a little bit more thoroughly.

polack 6y ago

Feels fair that it's happening to companies that hand over our data to third parties. Anything that can open the general public's eyes to how much data is leaked through these kind of practices is a good thing. Hope it amounts to some non-negligible loss for Facebook, Spotify and the others.

Austin_Conlon 6y ago

They never responded to my request for a postmortem on the previous blunder: https://github.com/facebook/facebook-ios-sdk/issues/1385 https://github.com/facebook/facebook-ios-sdk/issues/1385.

NAR8789 6y ago
Anyone reading this, please make some noise that request for postmortem. https://github.com/facebook/facebook-ios-sdk/issues/1385 https://github.com/facebook/facebook-ios-sdk/issues/1385 I want a central document with clear steps on how to mitigate. Currently the best option for documentation seems to be wading through comment threads, which is very frustrating.
booleanbetrayal 6y ago
Maybe if Facebook were actually required to provide post-mortems, the developers would be more cautious about creating these outages in the first place. One thing's for certain, the silence is infuriating.
- delecti 6y ago
  Being "required" to provide post-mortems doesn't always mean they will actually do it.

peteretep 6y ago

I fucking hate that Spotify uses this.

Schiendelman 6y ago
Use Apple Music!
- pferde 6y ago
  Or just keep your music collection local and laugh in disbelief at these Black Mirror-esque problems. The simple act of listening to music should not require a vast server infrastructure at the other end of the world, under control of a third party, and a working global communications network. The fact that people got used to this kind of nonsense is very, very scary to me.
  - duval 6y ago
    What is so scary about there being a market for a flat fee service allowing you to listen to any song you want, any time you want? The act of listening to music doesnt require a vast server infrastructure. Thats why people could still listen to music they had stored offline during the outage.
- valuearb 6y ago
  Apple Music doesn't work most of time, that's why I switched to Spotify.
  - theshrike79 6y ago
    How can a music app "not work"?
    - valuearb 6y ago
      Refuses to play unless restarted. Every single day. Forgets selected play list from previous day. Every single day. Sometimes would play to wrong audio output, which would produce the same silence as first problem but restarting/ rebooting wouldn’t fix. Finally I’d realize and switch it back in control panel.

rimliu 6y ago

I cannot take anything Facebook does (at least on iOS) seriously since the day they were bragging (with straight faces) about having so many classes that Xcode could not cope with them. And IIRC, lots of them were auto-generated and never pruned.

Google234 6y ago

This seems insane to me. Who rolled out this change? Why can’t they just roll it back

heavenlyblue 6y ago

Spotify is the same for me today

bernardlunn 6y ago

Memo to dev team - pay attention to tech stack risk

adamparsons 6y ago

My personal anecdote: I’m parked over on the side of the road because my carplay habits of Spotify and Waze both kept crashing to the dashboard. I couldn’t help but notice neither app worked even after a reboot, yet google maps did. I was thinking there was a carplay bug and then thought: “oh boy here we go, what are the odds, let’s check hackernews” and bam, of course it’s the Facebook sdk again I’m thankful that googles iOS-chrome and google maps doesn’t use the Facebook sdk for something...

drcongo 6y ago

None of the apps on my phone are crashing because of this. I also don't have a Facebook account, nor do I have the Facebook app installed. So it looks like there's an easy fix, delete your account, delete Facebook.

didntlogin 6y ago
The issue got resolved 5 minutes ago.
- drcongo 6y ago
  And everything was already working for me fine before that. Admittedly I do also have every Facebook domain blocked through NextDNS.

bloemy 6y ago

Seems like it's just been fixed again. All apps are working.

bloemy 6y ago

Seems like it's been fixed just now. All apps are working again.

Reason077 6y ago
Yes, Spotify appears to have been hotfixed at least. Was 100% crashing for me earlier this morning. Working fine now.

lyjackal 6y ago

Top Google trending search suggestion on my phone right now: "iphone spotify app keeps crashing"

numpad0 6y ago

For end users who need affected apps right now: 1) Download NextDNS from App Store 2) Open app. Hit (...) 3) Enable Custom Configuration, Config ID 22776a It’ll DNS block some ads and Facebook domains. Turn off after you’re done. Also assume any DNS server offered by random dude as poisoned. Edit: Issue resolved! People, turn it off or switch to your own configuration.

Jakob 6y ago

You can disable the Facebook SDK phoning home: https://developers.facebook.com/docs/app-events/gdpr-compliance https://developers.facebook.com/docs/app-events/gdpr-complia... Any idea why seemingly no one of the big apps does this?

radisb 6y ago

Not to sound as old or anachronistic but I kind of watch this stuff happening and wonder when all those useless bubbly conveniences are going to burst. Never had any account on facebook, twitter, instagram, viber, whatsapp etc. Last similar stuff i used was IRC and ICQ. Some Messenger and skype but i abandoned those long ago. Now I only use discord when I am gaming or wanna talk to a friend and I am sitting in my desk. Mobile phones were a big step forward from plain old landline ones. But in terms of ease of communication this change was the last one with non-deminishing returns. Maybe smart phones also just for browsing HN when I wait in a queue or in the bus etc. All those social networking and communication apps? Fcuk them. I can perfectly communicate by calling or texting or video calling someone. What exactly is the added value of those apps?

valuearb 6y ago
If you are Spotify, it provided a seamless experience for millions of people to sign up for their service. Now they have a lockin problem, and need to figure out how to migrate those accounts to another authentication service. And for Communication, you never use Slack? It's useful to segment your communications by type, I don't want to give random Tinder ladies my home phone number.
- radisb 6y ago
  I don’t use tinder. I don’t use slack

deleted 6y ago

[deleted]

sjg007 6y ago

I've noticed FB crashing as well.

marinosbern 6y ago

While Spotify crashing on launch may be a nuisance, this also affects life-critical apps crashing on launch. Our forensic analysis [1] found that half of the top 21 iOS safety apps send data to Facebook, and last time this happened back in May we spot-checked some of these safety apps and they were all crashing on launch. The SDK is typically included for ad attribution/tracking, not Facebook login, so it wouldn’t even be visible to the end user, and there’s no way to disable it. [1] https://parachute.live/blog/forensic-investigation-the-shocking-state-of-privacy-in-safety-apps https://parachute.live/blog/forensic-investigation-the-shock...

letitbeirie 6y ago
I've installed dozens of life-safety-critical services and none of them had ads or the Facebook SDK for very good reasons. AMA.
- marinosbern 6y ago
  > I've installed dozens of life-safety-critical services and none of them had ads or the Facebook SDK Can you give a few examples? > none of them had ads The comment was about the Facebook SDK being used for ad attribution, not that the apps themselves have ads.
swagonomixxx 6y ago
I'm sorry, but if someone is building a life-critical app and using Facebook, just, why? Do they want to tell FB about all your critical conditions too?

pluc 6y ago

Couldn't Find Advertisers

cpv 6y ago

Is this a Deja Vu https://news.ycombinator.com/item?id=23097459 https://news.ycombinator.com/item?id=23097459 ?

justinclift 6y ago

Wonder if it was due to an expired or revoked certificate? Maybe the mass revocation of EV certs happening ~today is the trigger?

bolmaster2 6y ago
Who is revoking EV certs today?
- justinclift 6y ago
  https://www.theregister.com/2020/07/10/digicert_pulls_certs/ https://www.theregister.com/2020/07/10/digicert_pulls_certs/

Hamuko 6y ago

I actually went to the post office today (couple of hours ago) and tried to use the national postal carrier's app to get my pickup code. The application just kept crashing. I showed it to the man at the counter and he said that others had had the same issue, although he didn't specify if it was earlier the same day or way back. I wonder if it was the same issue.

dathinab 6y ago

That is now the how manyth time this happened? Like wtf. they have so many resources how is it possible that even with that they can't make their sdk error resilient.

bschwindHN 6y ago

Stop using facebook's garbage! Or if you must, use their oauth flow and API but _don't_ include code of theirs you don't control directly in your binary. It's just asking for trouble. https://news.ycombinator.com/item?id=23099788 https://news.ycombinator.com/item?id=23099788

scottmf 6y ago
And then FB will ban your app.
- swagonomixxx 6y ago
  Ban it from where? Using their API?
  - zedpm 6y ago
    Yes, Facebook requires that any mobile app using Facebook login do so via their SDK. Presumably they will disable your Facebook app (breaking login) if you don’t comply.
    - lucasar 6y ago
      The above is correct. Facebook wants you to use the SDK.
    - tdrp 6y ago
      They told us that explicitly. We had been using the URL-based login on the app (i.e. open a browser with the URL and use the redirect to continue logging in), for almost two years. Then about a year ago, they e-mailed us just before a holiday and told us we had less than a week to move all of our apps to SDK otherwise they'd just disable us. Their argument was that "it's not providing the best possible experience to our users". There hadn't been a single complaint about it though. We had nearly 100,000 users logged into our app via Facebook login so we were basically strongarmed into complying. We somehow pulled it off before the deadline for both Android and iOS but felt really dirty afterwards.

dr-detroit 6y ago

Zuckerberg's monthy CIA funding cheque probably bounced

zacwest 6y ago

Apple's refusal to support XPC and the ability for apps to launch secondary processes is the real underlying issue here. Being able to separate out execution and process permissions from the main app solves a ton of third-party SDK issues as well as just normal "why is my app crashing because of decoding?"-style issues.

Spooky23 6y ago
Sure, I really want multiple crashing Facebook spy processes crashing on my phone continuously.

Tepix 6y ago

The DJI Fly app is also affected. Workaround: Start it in flight mode.

emerongi 6y ago

The most popular apps on one of the most popular operating systems just plainly don't even open. What has this industry become? How are we so goddamn inept at writing software? This is an industry where we can automate testing - not many other industries have this capability - and we still don't have a simple test regime of "check if the app opens" for any of those apps. Somehow, at the most valuable software companies of the world, nobody has set up a system that makes sure that you can't introduce a change that renders these apps unusable? WHAT THE FUCK. I have always been afraid of software engineering becoming a trade similar to medicine or law or (regular) engineering where significant barriers will be put up before you can enter the industry, but this sort of shit makes me feel like it could be for the better. I will have to go and get a degree, but that's the price I have to pay I guess.

rachelbythebay 6y ago
Years ago, I had one of the employee builds on my company phone, and it picked up an update and would "instacrash" - tap the icon, and it'd die immediately. Crash. Crash. Crash. A couple of days later I caught up with the people allegedly responsible for this stuff in the bigger review meeting. "Shouldn't you open a SEV because you are shipping stuff that can't possibly work and aren't catching it pre-release?" The response was a lot of hand-waving and stupid manager-speak that boiled down to "no, go away". I basically wrote them off at that point. If they could act that way and get away with it by way of implicit acceptance from upper management, that's just the way it was going to be. I see the quality is as high as always.
- exikyut 6y ago
  Curiously, this type of handwavy response reveals a not-quite-1:1 mapping between the sort of assertive, pro-admission, fail-forward balance that "move fast, break things" implies for me, and the apparent reality which seems closer to "haha crowdsourced QC go brrrrt" :(
- fsociety 6y ago
  Yep at such a large company there is such huge variance in quality. Wish you and many others were still here to help fight against this mindset. There is lots of high quality work done here, but it doesn’t matter if we end up with issues like this.

have_faith 6y ago

I was wondering why spotify wouldn't open earlier today. Updating it didn't help. And then later on it randomly started working again.

connorlwilkes 6y ago

The same kind of thing happened today with Spotify's application on iOS and this also happened about a month ago too. I am surprised that regression testing tools aren't picking up these issues before they push these updates out to user's devices

iamspoilt 6y ago

Oh is this why I couldn't play anything on Spotify during my morning run as it kept crashing! Had to play Apple Music's Beats 1 radio instead.

occamschainsaw 6y ago

I installed iOS 14 beta today and got mad at Apple because I thought the update broke so many apps on my phone. Turns out it was FB sdk coincidentally. One more reason to be mad at FB.

sigwinch28 6y ago
Same thing happened here. Spotify wouldn't open and I thought "oh no, I need to downgrade to listen to music via Spotify." Someone recommended airplane mode and lo and behold the app started working. This is Facebook's fault, but also Spotify's. How such an established platform with supposedly-established engineers can let a third party library crash their app at startup is genuinely embarrassing.

speedyapoc 6y ago

Issue seems to be resolved, but the the comment on their bug tracker is almost infuriating. “ Earlier today, a code change triggered crashes for some iOS apps using the Facebook SDK. We identified the issue quickly and resolved it. We apologize for any inconvenience.” (1) At the scale of Spotify and other massive blue chip apps, this bug could have very well cost companies hundreds of thousands to millions of dollars in damages. This apology on the bug tracker seems so insincere. With this type of issue occurring twice in a couple months, I’ll be ensuring that no clients of mine ever install or rely on Facebook services within their mobile apps. Facebook has a responsibility to developers to ensure that their SDKs and integrated components are stable, and they have failed. [1] https://developers.facebook.com/status/issues/1739188102911114/ https://developers.facebook.com/status/issues/17391881029111...

sigwinch28 6y ago
Assuming that developers of these apps get the same license we plebs get (i.e. NO WARRANTY), then I see very little recourse. Facebook are big enough to blow this off, and they know it. At least... they hope so.

johnvega 6y ago

Seems like FB way of forcing devs to use the latest SDK, unless FB shares technical details on what happened. This is what FB for dev says: "To make your app compatible with the latest iOS, be sure to use the latest Facebook SDKs for iOS." https://developers.facebook.com/docs/ios https://developers.facebook.com/docs/ios

barryrandall 6y ago

I'm looking forward to these future HN posts: "Increase iOS app reliability with this simple trick", "How I Increased retention 10x by canceling Facebook", and "Most popular app in world yanked for privacy violations"

sphix0r 6y ago

Insane. Good to know what made my Spotify app crash upon startup though.

lucasar 6y ago

It is evident that Facebook does not QA the way they should. It would be nice if Apple added mechanisms that allow a dependency in an app to crash but allow the host app to continue to run regardless.

nradov 6y ago

Apparently the Strava app is also impacted, and probably others as well.

cryptozeus 6y ago

I have switched to FB web version and uninstalled the app, this has worked very well for me. Its less engaging and I get to keep in touch with my family.

hnick 6y ago

I greatly appreciate the candid snark in the bug report. Sometimes there's just not much more to say.

jmspring 6y ago

The removal of FB and Google from my digital life are my goals for the next year/. Where I need FB (groups) it’ll be a fake account through a vpn/etc

neop1x 6y ago

Of course FB SDK could work only after a user requests its functionality by tapping or logging in. But no... they need to harvest analytics and track users as they do ad-business primarily... :(