5 ms·

that's not the only purpose of the SDK, we're using it for social login (login with Facebook).

by zuppy 6y ago

akerro 6y ago
But it's all or nothing right?
RL_Quine 6y ago
Why load it unless it’s being actively used for authentication?
- cassianoleal 6y ago
  Well, how do you get consistent tracking then? Obs: I'm being sarcastic but since it's either this or developer laziness, I'm betting on tracking since I always start from the principle that the developers analysed the situation and made an explicit choice.
  - Sephiroth87 6y ago
    Except, you know, when does a developer ever have a choice? You are asked to put the SDK in and you do it...
    - zuppy 6y ago
      this, combined with a wrong past technical decision that we can not change it instantly. unfortunately it's not as easy to fix mobile bugs as it is on the web, as you have to both pass the approval process and wait for the full rollout to clients. in our case, it's just a wrong decision, we don't use it for tracking. also, if you use facebook login, the terms and conditions force you to use their SDK (which automatically initialises when included and does this crap). https://developers.facebook.com/policy/ https://developers.facebook.com/policy/ - 8.2 "Native iOS and Android apps that implement Facebook Login must use our official SDKs for login. "
      - zentiggr 6y ago
        > we don't use it for tracking True, you're just facilitating, not profiting. Such a clear and obvious good reason to drop support and walk away.
        Sephiroth87 6y ago
        Some people like to keep their job...
      - cassianoleal 6y ago
        Just to clarify, when I say "the developer" I don't necessarily mean the person writing the code: I mean the organisation developing the software, so they definitely have the choice. In terms of the person writing the code, they can certainly push back. Being asked to add the Facebook SDK is either a red flag enough for him/her to do so, or they don't mind. In either case, they've made that choice.
0xy 6y ago
Spyware isn't not spyware because it's useful to a minority of users sometimes. You throw all of your users under the tracking bus by doing this.
Nextgrid 6y ago
You can implement OAuth entirely server-side without any client support beyond displaying a web view. No need to include spyware and the approach is reusable for any OAuth provider.
- akmarinov 6y ago
  You can’t, it’s against their policy, if they catch you they’ll revoke your access. developers.facebook.com/policy/ 8.2 (which states “Native IOS and Android apps that implement Facebook Login must use our official SDKs for login.” This has a help icon next to it that opens a dialog on their site that shows a couple pictures and then explains “Android apps should use the default login behavior defined by the SDK, which may use the web-view Login dialog. On iOS, only kiosk apps may use a web-view Login dialog.”
  - Nextgrid 6y ago
    A generic login experience on the web (where the entire login flow is implemented in the browser and the login button just redirects to Safari, including for email/password accounts) should work around it. You can provide technical reasons as excuses for why it's impossible for your app to include edge cases for each login provider to be included natively in the app.
  - delfinom 6y ago
    You understand the subtext here right? They literally want you to install their malware on users devices so you can use their SSO. That's the entire ploy. It's how they ensure their malware spreads.
  - zentiggr 6y ago
    So do what the GP was hinting at and drop support for Facebook login, drop the SDK, wash your hands and sleep better as well.
    - zuppy 6y ago
      this is not how real life works, you don’t get to choose all the features and you can’t quit jobs every time you’re asked to integrate a sdk. also, you are suggesting that it is a good option to drop support for all the customer accounts that have used fb login, this is silly. sometimes i wonder if you people lost all the connections with the reality... or if you were ever employed.
mvanbaak 6y ago
You can implement that without the SDK. This is no excuse!

that's not the only purpose of the SDK, we're using it for social login (login with Facebook).

by zuppy 6y ago

that's not the only purpose of the SDK, we're using it for social login (login with Facebook).

akerro 6y ago

But it's all or nothing right?

RL_Quine 6y ago

Why load it unless it’s being actively used for authentication?

cassianoleal 6y ago
Well, how do you get consistent tracking then? Obs: I'm being sarcastic but since it's either this or developer laziness, I'm betting on tracking since I always start from the principle that the developers analysed the situation and made an explicit choice.
- Sephiroth87 6y ago
  Except, you know, when does a developer ever have a choice? You are asked to put the SDK in and you do it...
  - zuppy 6y ago
    this, combined with a wrong past technical decision that we can not change it instantly. unfortunately it's not as easy to fix mobile bugs as it is on the web, as you have to both pass the approval process and wait for the full rollout to clients. in our case, it's just a wrong decision, we don't use it for tracking. also, if you use facebook login, the terms and conditions force you to use their SDK (which automatically initialises when included and does this crap). https://developers.facebook.com/policy/ https://developers.facebook.com/policy/ - 8.2 "Native iOS and Android apps that implement Facebook Login must use our official SDKs for login. "
    - zentiggr 6y ago
      > we don't use it for tracking True, you're just facilitating, not profiting. Such a clear and obvious good reason to drop support and walk away.
      - Sephiroth87 6y ago
        Some people like to keep their job...
    - cassianoleal 6y ago
      Just to clarify, when I say "the developer" I don't necessarily mean the person writing the code: I mean the organisation developing the software, so they definitely have the choice. In terms of the person writing the code, they can certainly push back. Being asked to add the Facebook SDK is either a red flag enough for him/her to do so, or they don't mind. In either case, they've made that choice.

0xy 6y ago

Spyware isn't not spyware because it's useful to a minority of users sometimes. You throw all of your users under the tracking bus by doing this.

Nextgrid 6y ago

You can implement OAuth entirely server-side without any client support beyond displaying a web view. No need to include spyware and the approach is reusable for any OAuth provider.

akmarinov 6y ago
You can’t, it’s against their policy, if they catch you they’ll revoke your access. developers.facebook.com/policy/ 8.2 (which states “Native IOS and Android apps that implement Facebook Login must use our official SDKs for login.” This has a help icon next to it that opens a dialog on their site that shows a couple pictures and then explains “Android apps should use the default login behavior defined by the SDK, which may use the web-view Login dialog. On iOS, only kiosk apps may use a web-view Login dialog.”
- Nextgrid 6y ago
  A generic login experience on the web (where the entire login flow is implemented in the browser and the login button just redirects to Safari, including for email/password accounts) should work around it. You can provide technical reasons as excuses for why it's impossible for your app to include edge cases for each login provider to be included natively in the app.
- delfinom 6y ago
  You understand the subtext here right? They literally want you to install their malware on users devices so you can use their SSO. That's the entire ploy. It's how they ensure their malware spreads.
- zentiggr 6y ago
  So do what the GP was hinting at and drop support for Facebook login, drop the SDK, wash your hands and sleep better as well.
  - zuppy 6y ago
    this is not how real life works, you don’t get to choose all the features and you can’t quit jobs every time you’re asked to integrate a sdk. also, you are suggesting that it is a good option to drop support for all the customer accounts that have used fb login, this is silly. sometimes i wonder if you people lost all the connections with the reality... or if you were ever employed.

mvanbaak 6y ago

You can implement that without the SDK. This is no excuse!