A Facebook SDK crash caused iOS apps like TikTok and Venmo to crash on Wednesday, showing the need for Apple to sandbox third-party SDKs from an app's own code
This crash is not a one-off in the corpus: the same Facebook SDK failure recurred two months later, when another roughly three-hour outage took down TikTok, Spotify, Tinder, and Pinterest via Facebook Login. Two incidents in one summer turned a developer nuisance into a structural question about how much of an iOS app's stability rides on embedded third-party code.
It also lands against a backdrop of friction between Apple and Facebook on iOS: in early 2019 Apple shut down Facebook's ability to distribute internal iOS apps over its enterprise-certificate use, establishing that Apple will act directly against Facebook's iOS footprint when it sees fit.
First-order effects
Apps like TikTok and Venmo went down without any defect in their own code — every developer that embedded the Facebook SDK inherited its failure mode instantly and had no independent fix short of shipping an update without it.
Second-order effects
The July recurrence showed the exposure is systemic rather than incidental, giving developers a concrete reason to weigh whether Facebook Login's reach justifies coupling their app's uptime to Facebook's release process — and handing Apple a ready-made case for intervening.
Third-order effects
If Apple moves to sandbox third-party SDKs from an app's own code, App Store governance would extend from reviewing the binary a developer submits to policing the embedded components inside it — a structural expansion of the gatekeeper role, with Facebook's SDK as the test case given the companies' prior clashes.
The trend: Platform gatekeepers are being pushed to extend oversight from the apps they review to the third-party SDKs embedded within them, with repeated Facebook SDK outages as the forcing function.
To stop crashes from the Facebook SDK, some devs tried commenting out any code that calls Facebook. Nothing worked. It turns out that by just including the SDK with your app, Facebook runs hidden code on launch. (FBSDKApplicationDelegate.m) https://twitter.com/...
It's not just Spotify, here is a current list of all the apps that aren't working right now: -Spotify -TikTok -Pinterest -Venmo -Doordash -Tinder -The Walmart App -Google -Bumble -Soundcloud There's more, your phone isn't broken, it's the apps
Last week, a Google SDK crash took down all gig economy apps. Today, a Facebook SDK crash killed Tinder, TikTok, Spotify, Pinterest and other apps with FB Login enabled: https://www.theverge.com/... The blast radius of Facebook and Google SDKs is incredible. https://twitter.com/.…
2 major global outages in many apps caused by 3rd party SDKs in 2 weeks. I didn't expect to be talking about this again so soon, but here we are again with the Facebook SDK... https://github.com/...
If I were Apple, I would be working hard on finding a way to “sandbox” these types of SDKs from the main app binary, to prevent issues like this (and leakage of user data to third-parties). https://twitter.com/...
The Facebook SDK breaking half the apps in the world for a few hours is a good reminder of why developers need to think a bit harder before dumping 3rd party code into their apps, especially proprietary SDKs. Facebook SDK does way more than “just” provide a native login flow! htt…
Just like its infamous counterpart @Firebase, expect any spyware SDK to act for the main purpose: harvesting your users data. They usually try to do it discretely, but sometimes it goes sideways, like today with the FB SDK massive crash https://twitter.com/...
There are a lot of reasons not to use +load in Objective-C code, global constructors in C++, or C functions with marked with a special attribute. This is especially true if your code is going to be used in contexts you don't control. Like, providing an SDK to 3rd parties. https:/…
If you want to learn more about the Facebook issue that took down many iOS apps yesterday, read this this great explainer from @nickstatt. https://www.theverge.com/...
Simply put, we have to demand of our technology what we have of our food, clothing, medicine and other essential needs: visibility into how they're supplied & sourced, understanding the workers & working conditions that shape them, and accountability when the system has failures.