{"id":28891,"date":"2020-05-07T15:51:07","date_gmt":"2020-05-07T19:51:07","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=28891"},"modified":"2020-05-14T15:06:42","modified_gmt":"2020-05-14T19:06:42","slug":"facebook-sdk-causes-crashes","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2020\/05\/07\/facebook-sdk-causes-crashes\/","title":{"rendered":"Facebook SDK Causes Crashes"},"content":{"rendered":"

Juli Clover<\/a> (Hacker News<\/a>):<\/p>\n

Multiple iPhone and iPad users are seeing their apps crashing at launch as of this afternoon, and the issue appears to be caused by a faulty Facebook SDK that the apps are using.<\/p>\n

[…]<\/p>\n

Multiple developers on GitHub<\/a> have attributed the problem to a Facebook software development kit used by the apps for sign-in purposes. Apps are failing to open even when users do not use the Facebook login options included.<\/p><\/blockquote>\n\n

Crashlytics<\/a>:<\/p>\n

\n

Due to a major increase in crashes across the iOS ecosystem caused by an issue with a popular iOS SDK, iOS crash processing in Crashlytics was disabled at 11:00 PM UTC.<\/p>\n<\/blockquote>\n\n

So many crashes that it brought down the crash reporter.<\/p>\n\n

Ben Sandofsky<\/a>:<\/p>\n

\n

To stop crashes from the Facebook SDK, some devs tried commenting out any code that calls Facebook. Nothing worked.<\/p>\n

It turns out that by just including the SDK with your app, Facebook runs hidden code on launch. (FBSDKApplicationDelegate.m)<\/p>\n<\/blockquote>\n\n

Guilherme Rambo<\/a> (tweet<\/a>):<\/p>\n

The issue was caused by some bad data being sent by Facebook’s server to their SDK, which caused code in the SDK to crash, which in turn brought down the app that was running the SDK. Since this happened during the initialization of the SDK — something that occurs right after launching the app — the apps simply became unusable. You can read more about it here<\/a>.<\/p>\n

I did find a workaround that allowed me to order dinner though. Since the crash was caused by data sent by Facebook’s servers, I blocked the facebook.com<\/code> domain (and all of its subdomains) on my network using Pi-Hole<\/a>.<\/p>\n

[…]<\/p>\n

The other solution would be some form of sandboxing that isolates this type of SDK from the main app code. Apple’s operating systems already have and use XPC extensively — and iOS supports extensions — but it still doesn’t expose such functionality to developers.<\/p><\/blockquote>\n\n

Anil Dash<\/a>:<\/p>\n

The flagship mobile apps from Google, Spotify, Apple, NYT, Venmo, Walmart and many other huge companies all broke for about 30 minutes.<\/p>\n

[…]<\/p>\n

Done right, open source is magic. It gives coders super powers to build things they could never do alone. But it can also be a strategy that makes huge parts of our online experience dependent on a few companies, and vulnerable to their choices. The failure that millions of people experience today was just (“just”) some apps crashing for a little while. A few weeks ago, it was Zoom using a Facebook library that sent data in ways they didn’t disclose. We don’t have a cultural fluency in how to talk about the interconnectedness of all the tech around us.<\/p><\/blockquote>\n\n

Apple and Google use the Facebook SDK?<\/p>\n\n

John Gruber<\/a>:<\/p>\n

\n

Facebook themselves are no dummies. None of their iOS apps ever break because of a bug from Google or Adobe, because they’re not foolish enough to bake in a dependency they don’t control.<\/p>\n<\/blockquote>\n\n

Previously:<\/p>\n