Hacker News Reader

Comment by andersco | Hacker News Reader

How is it that a third party SDK is consistently causing apps to completely crash rather than, for example, displaying an error message? Is this a failure that cannot be caught? Sorry, just trying to understand. The dependency relationship just seems to be extreme.

View on HN

>To stop crashes from the Facebook SDK, some devs tried commenting out any code that calls Facebook. Nothing worked.

>It turns out that by just including the SDK with your app, Facebook runs hidden code on launch. (FBSDKApplicationDelegate.m)

[0] https://twitter.com/sandofsky/status/1258288056399847425

... so if the app including the SDK has permission to access location data, the SDK could be passing that location data to Facebook?

Yes.

Not only could it do that, but it also totally does do that

Didn't they also use to home in information about surrounding bluetooth devices? When iOS 13 beta dropped, half of the apps suddenly asked for bluetooth permissions because Google/FB SDKs attempted to use it on app launch.

Not sure about Bluetooth devices, but the Facebook SDK definitely phones home with some system data and generates an unique identifier on first launch which is then included every further interaction the SDK has. Both of these enable fingerprinting and persistent tracking.

My guess in this particular instance is that it seems like the Facebook SDK is fetching some sort of remote serialized configuration, calling “count” on what it expects to be an array, and instead is calling it on NSNull (an object representing “null”) which is throwing an exception.

There are some intricacies on iOS surrounding null values and serialization, and as a developer it is important to understand that you may encounter NSNull. As a standard practice in my company, we type check every remote value before calling anything on it. Seems like that would have prevented this issue.

Could also be a string that’s no longer there

Source: have had that issue before

Also maybe it’s time for them to start rewriting things in Swift, where this would be much less likely to happen

True enough. Swift Codable with optional properties handles this automatically.

This is exactly what happens. Basically a null value is converted into an NSNull object and calling count on it will of course throw an exception... because there is no count method in that class...

It makes me wonder what all those engineers at FB are actually doing... ? Every time I tried to integrate or look into the FB SDK for simple functionality it was a total clusterfuck.

Sounds like a good reason to stop trying.

A bit of snark but also maybe stop trying to use a data collection engine to leverage anything for yourself?

That's amateur hour stuff. Every developer in pretty much every language or platform learns VERY quickly what happens when you don't do a null check.

NSNull is not the null you think

It may not be a conventional null, but I'm not aware of any tech where calling "count" on a Null, .nil? or otherwise null-like construct won't end horribly.

The Facebook SDK is written in obj-c, where calling `count` on `nil` is perfectly valid and returns 0. It only doesn't work on NSNull, which is a weird different thing that does not work like the language's built-in null.

I believe last time this happened it was because they were running code (including network requests) in a callback that gets called when they were loaded by the dynamic linker.

I'm curious about this as well. I've always written frameworks to be used with a 'Policy Layer -> Mechanism Layer -> Utility Layer' general architecture. Each layer captures and does its best to handle errors in a way you would expect that layer to. The only time errors move up towards the policy layer is explicitly because the next layer up will handle it.

Well SDKs may do their own initialization upon being loaded into the app which might be the cause here as the crash occurs on launch.

People are using third party code without fully understanding what they’re bringing in or the consequences of bringing it in.

Reply on news.ycombinator.com