SEEKING WORK // San Francisco, CA // Remote

PORTFOLIO: http://www.punkhouse.co // EMAIL: rohan@punkhouse.co

PUNK HOUSE: A technical duo creating software for interesting new tech plays. Most recently built the software from scratch @ Backbone (https://playbackbone.com — featured on Forbes, TC, Verge, etc. and backed by the biggest names in gaming & entertainment) and co-created Winno (https://apple.co/winno — featured 2x as Apple's App Of The Day). Have worked on frontend & backend for Snackpass, Grab, NUGGS, Stanford, Yale, Butterfly, Singapore Post, and more. Independently published an AI blog (https://AYearOfAI.com) with 300,000+ reads, featured on a16z's AI primer; and created a CryptoKitties inspired Ethereum gaming platform (https://CryptoBets.cc).

i mean, they offer FB sign in in the app, so the FB SDK is bundled with the app binary. looks like the mere presence of the library is causing crashes. someone on a related GH thread noted they commented out the code invoking the FB SDK but the issue remained.

Yeah these SDKs are siphoning off data without authorization like your location, songs you listen to and who knows what else (eg other processes or apps running on your phone). Eg the latest iOS exploit allows any app to get access to all SMS data. Tech companies of today trample upon individual privacy openly. Amazing!

i'm by a longshot no facebook fan but... are you sure the SDK can actually siphon out what songs you listen or your location from the app it's sandboxed in (which, BTW, is in its own sandbox from an iOS system POV, and also has its own set of permissions)?

I am an iOS developer and most likely the problem is related to configuration and basic analytics, not "siphoning" app data.

Offending code :

if (restrictiveParams[eventName][@"is_deprecated_event"]) {

        [deprecatedEventSet addObject:eventName];

}

So, the iOS library does not check for nil, and whatever the server is returning does not have the expected content. Lame.

Looks like that would've probably been caught if it were written in Swift.

    if (restrictiveParams[eventName] as! [String: Any])["test"] != nil

In Swift, now hopefully you wouldn't write this code but it's not entirely unlikely too. In fact the above Objective-C snippet is one of the few cases where Objective-C's forgiving `nil` behaviour doesn't save you from a crash.

Well the reason FB/Foursquare/Google etc add these to 3rd party apps is so they can get data. Example if you visit a website which has a Facebook like button, your browser fetches the js files/which maybe even makes an API call to let FB know your IP (and hence location). All this data is fed to the giant system that feeds you ads. Adding their SDK to other apps/sites (even if there is no user facing need) is a common strategy used by most big companies to get data. In return the app that puts in the SDK gets $ from the company.

Of the companies you named, Foursquare's business model explicitly revolves around paying apps for user location data and selling it.

I doubt (and at least from my experience around SV, haven't seen) that FB/Google are paying apps to include their SDKs.

I have been witness to such business partnerships to embed SDKs to siphon telemetry/other data. The world is not as simple as you think...

well, this would be extremely believable

If you only need login, then you can have the same functionality without the Facebook SDK or Google SDK by using OAuth.

I think he's talking in general. I worked at Spotify for a while and I can tell you the only reason they have the FB SDK bundled is to provide login. They dont use FB for any tracking or attribution at all, for that they have other frameworks. They are aware of the FB SDK misbehaving in some cases and do take steps to prevent it.

Yes, requiring the SDK to implement Facebook Login is the decision that's being criticized. Facebook encourages SDK usage obviously for the data collection it enables, but even they provide an OAuth-only login flow that doesn't require the SDK at all: https://developers.facebook.com/docs/facebook-login/manually...

Then if this can be fixed by a server side change as suggested below, that's worrisome, since it suggests it is communicating with FB even if you don't invoke it.

the real question though is if the library is not even imported into the main app and just left hanging around, linked, would it still crash? i'd be curious to know

Apparently yes: https://news.ycombinator.com/item?id=23097887

Correct, as the code is run as the dynamic linker pulls in the library (which is usually at application startup).

it will probably take time to propagate (edit: though i didn't expect this much time, still crashing!)

Also: Tinder, Venmo, GrubHub (think of the botched deliveries heh), and more. An ongoing list here: https://twitter.com/aburninghilll/status/1258169688959352832

Also see: https://github.com/facebook/facebook-ios-sdk/issues/1373

Holy shit this is awesome, thanks so much. I'm starting a creator collective/technology studio and this is a great resource.

posting this because im wondering what the legal implications of betting w crypto are?

Hey guys, one of the makers of Contra here, and we're super excited to launch Contra to the world!

Contra is a new way to get educated on any circumstance, be it a product comparison, news article, or current affair. Post two-sided topics, and acquire a well-rounded portfolio of opinions from multiple people! And if you're feeling strongly about something - go ahead and write your own opinion.

If you have any questions or feedback we'd love to hear it! Reach out to us!

Do download the app, too!

Looks great!!