5 ms·

How is it that a third party SDK is consistently causing apps to completely crash rather than, for example, displaying an error message? Is this a failure that

How is it that a third party SDK is consistently causing apps to completely crash rather than, for example, displaying an error message? Is this a failure that cannot be caught? Sorry, just trying to understand. The dependency relationship just seems to be extreme.

nicoburns 6y ago
I believe last time this happened it was because they were running code (including network requests) in a callback that gets called when they were loaded by the dynamic linker.
yreg 6y ago
>To stop crashes from the Facebook SDK, some devs tried commenting out any code that calls Facebook. Nothing worked. >It turns out that by just including the SDK with your app, Facebook runs hidden code on launch. (FBSDKApplicationDelegate.m) [0] https://twitter.com/sandofsky/status/1258288056399847425 https://twitter.com/sandofsky/status/1258288056399847425
- harryf 6y ago
  ... so if the app including the SDK has permission to access location data, the SDK could be passing that location data to Facebook?
  - layoutIfNeeded 6y ago
    Yes.
  - akmarinov 6y ago
    Not only could it do that, but it also totally does do that
    - yreg 6y ago
      Didn't they also use to home in information about surrounding bluetooth devices? When iOS 13 beta dropped, half of the apps suddenly asked for bluetooth permissions because Google/FB SDKs attempted to use it on app launch.
      - Nextgrid 6y ago
        Not sure about Bluetooth devices, but the Facebook SDK definitely phones home with some system data and generates an unique identifier on first launch which is then included every further interaction the SDK has. Both of these enable fingerprinting and persistent tracking.
    - bsenftner 6y ago
      The fact that we as in industry and we as citizens of free nations do not end these operations, terminate their corporate charters and throw the responsible in jail is indicator #1 that freedom (not the GOP free-dumb) as we know it is in it's death rattle.
      - wolco 6y ago
        Why are people using the facebook sdk? What does it give them?
        mromanuk 6y ago
        I'm using it for realtime analytics (dashboard like mixpanel) also this brings authentication and other FB Integration
        berkes 6y ago
        When we looked at it, we saw several reasons, all of which are dubious at best: 1. It is required for a "login with Facebook" feature, apparently. I'd presume this goes for other feautures that integrate with facebook, such as "invite from your friends" or "share on facebook(messenger)". 2. It gives access to metrics, when added to your own, greatly enrich your own data collection. 3. It is required when working with Facebook ads - though I would not know how this ties in with mobile apps: on web it is clearer (where you are required to host "the pixel" on your website in order to have ads on facebook link to that website.) 4. It is feature rich, so as a pure SDK, it offers neat utilities; though for each of these, there are better alternatives found in separate libs.
        harryf 6y ago
        Extending point 2, it’s essential if you’re running ads on Facebook and want to know if clicks on the ad in Facebook bring the user through to the app - ie so you can be sure you got a real conversion
        yalok 6y ago
        @harryf there’s a way to send ads attribution via server API, so no need to have client side FB SDK for that
speedyapoc 6y ago
My guess in this particular instance is that it seems like the Facebook SDK is fetching some sort of remote serialized configuration, calling “count” on what it expects to be an array, and instead is calling it on NSNull (an object representing “null”) which is throwing an exception. There are some intricacies on iOS surrounding null values and serialization, and as a developer it is important to understand that you may encounter NSNull. As a standard practice in my company, we type check every remote value before calling anything on it. Seems like that would have prevented this issue.
- akmarinov 6y ago
  Could also be a string that’s no longer there Source: have had that issue before Also maybe it’s time for them to start rewriting things in Swift, where this would be much less likely to happen
  - sciprojguy 6y ago
    True enough. Swift Codable with optional properties handles this automatically.
- AndrewZM 6y ago
  This is exactly what happens. Basically a null value is converted into an NSNull object and calling count on it will of course throw an exception... because there is no count method in that class... It makes me wonder what all those engineers at FB are actually doing... ? Every time I tried to integrate or look into the FB SDK for simple functionality it was a total clusterfuck.
  - zentiggr 6y ago
    Sounds like a good reason to stop trying. A bit of snark but also maybe stop trying to use a data collection engine to leverage anything for yourself?
  - x86_64Ubuntu 6y ago
    That's amateur hour stuff. Every developer in pretty much every language or platform learns VERY quickly what happens when you don't do a null check.
rvz 6y ago
Well SDKs may do their own initialization upon being loaded into the app which might be the cause here as the crash occurs on launch.
iratewizard 6y ago
I'm curious about this as well. I've always written frameworks to be used with a 'Policy Layer -> Mechanism Layer -> Utility Layer' general architecture. Each layer captures and does its best to handle errors in a way you would expect that layer to. The only time errors move up towards the policy layer is explicitly because the next layer up will handle it.
chooseaname 6y ago
People are using third party code without fully understanding what they’re bringing in or the consequences of bringing it in.

nicoburns 6y ago

I believe last time this happened it was because they were running code (including network requests) in a callback that gets called when they were loaded by the dynamic linker.

yreg 6y ago

>To stop crashes from the Facebook SDK, some devs tried commenting out any code that calls Facebook. Nothing worked. >It turns out that by just including the SDK with your app, Facebook runs hidden code on launch. (FBSDKApplicationDelegate.m) [0] https://twitter.com/sandofsky/status/1258288056399847425 https://twitter.com/sandofsky/status/1258288056399847425

harryf 6y ago
... so if the app including the SDK has permission to access location data, the SDK could be passing that location data to Facebook?
- layoutIfNeeded 6y ago
  Yes.
- akmarinov 6y ago
  Not only could it do that, but it also totally does do that
  - yreg 6y ago
    Didn't they also use to home in information about surrounding bluetooth devices? When iOS 13 beta dropped, half of the apps suddenly asked for bluetooth permissions because Google/FB SDKs attempted to use it on app launch.
    - Nextgrid 6y ago
      Not sure about Bluetooth devices, but the Facebook SDK definitely phones home with some system data and generates an unique identifier on first launch which is then included every further interaction the SDK has. Both of these enable fingerprinting and persistent tracking.
  - bsenftner 6y ago
    The fact that we as in industry and we as citizens of free nations do not end these operations, terminate their corporate charters and throw the responsible in jail is indicator #1 that freedom (not the GOP free-dumb) as we know it is in it's death rattle.
    - wolco 6y ago
      Why are people using the facebook sdk? What does it give them?
      - mromanuk 6y ago
        I'm using it for realtime analytics (dashboard like mixpanel) also this brings authentication and other FB Integration
      - berkes 6y ago
        When we looked at it, we saw several reasons, all of which are dubious at best: 1. It is required for a "login with Facebook" feature, apparently. I'd presume this goes for other feautures that integrate with facebook, such as "invite from your friends" or "share on facebook(messenger)". 2. It gives access to metrics, when added to your own, greatly enrich your own data collection. 3. It is required when working with Facebook ads - though I would not know how this ties in with mobile apps: on web it is clearer (where you are required to host "the pixel" on your website in order to have ads on facebook link to that website.) 4. It is feature rich, so as a pure SDK, it offers neat utilities; though for each of these, there are better alternatives found in separate libs.
        harryf 6y ago
        Extending point 2, it’s essential if you’re running ads on Facebook and want to know if clicks on the ad in Facebook bring the user through to the app - ie so you can be sure you got a real conversion
        yalok 6y ago
        @harryf there’s a way to send ads attribution via server API, so no need to have client side FB SDK for that

speedyapoc 6y ago

My guess in this particular instance is that it seems like the Facebook SDK is fetching some sort of remote serialized configuration, calling “count” on what it expects to be an array, and instead is calling it on NSNull (an object representing “null”) which is throwing an exception. There are some intricacies on iOS surrounding null values and serialization, and as a developer it is important to understand that you may encounter NSNull. As a standard practice in my company, we type check every remote value before calling anything on it. Seems like that would have prevented this issue.

akmarinov 6y ago
Could also be a string that’s no longer there Source: have had that issue before Also maybe it’s time for them to start rewriting things in Swift, where this would be much less likely to happen
- sciprojguy 6y ago
  True enough. Swift Codable with optional properties handles this automatically.
AndrewZM 6y ago
This is exactly what happens. Basically a null value is converted into an NSNull object and calling count on it will of course throw an exception... because there is no count method in that class... It makes me wonder what all those engineers at FB are actually doing... ? Every time I tried to integrate or look into the FB SDK for simple functionality it was a total clusterfuck.
- zentiggr 6y ago
  Sounds like a good reason to stop trying. A bit of snark but also maybe stop trying to use a data collection engine to leverage anything for yourself?
- x86_64Ubuntu 6y ago
  That's amateur hour stuff. Every developer in pretty much every language or platform learns VERY quickly what happens when you don't do a null check.

rvz 6y ago

Well SDKs may do their own initialization upon being loaded into the app which might be the cause here as the crash occurs on launch.

iratewizard 6y ago

I'm curious about this as well. I've always written frameworks to be used with a 'Policy Layer -> Mechanism Layer -> Utility Layer' general architecture. Each layer captures and does its best to handle errors in a way you would expect that layer to. The only time errors move up towards the policy layer is explicitly because the next layer up will handle it.

chooseaname 6y ago

People are using third party code without fully understanding what they’re bringing in or the consequences of bringing it in.