Thread

Firebase SDK is crashing all iOS apps since this morning

132 points · 72 comments · pranshuchittora

Loading the complete thread in the background. This saved snapshot is available now. Refresh

pranshuchittora · 1790670636 · focus · HN ↗
Resolved - <a href="https://github.com/firebase/firebase-ios-sdk/issues/16728#issuecomment-5884287771" rel="nofollow">https://github.com/firebase/firebase-ios-sdk/issues/16728#is...
1. lol768 · 1790671593 · focus · HN ↗
  Resolved, but can still affect customers for up to 4 hours...
  So many problems here, and no signs of an updated SDK that behaves properly on malformed input.
yreg · 1790672142 · focus · HN ↗
This is not the first time this has happened.
illegalbyte2 · 1790672556 · focus · HN ↗
I was wondering why random apps kept crashing today. Good to know.
1. pranshuchittora · 1790672947 · focus · HN ↗
  But this is completely not acceptable from the Google
  1. solarkraft · 1790674495 · focus · HN ↗
    They’ve been accepting this for years and so have users
    whstl · 1790692125 · focus · HN ↗
    It has been completely normalized and rationalized by the tech community.
    Small company is down? Time to move to something else. Pitchforks.
    AWS goes down, or Google brings down half the internet? Well lots of other apps are down, so it's not a problem.
ChrisMarshallNY · 1790672873 · focus · HN ↗
Ugh.
That's the dark side of these types of dependencies.
But they provide a great deal of utility, so I can understand the attraction.
1. amelius · 1790673604 · focus · HN ↗
  I guess it's time Apple sherlocked Firebase.
  1. saagarjha · 1790676610 · focus · HN ↗
    You can write your own crash reporter now.
  2. oefrha · 1790677456 · focus · HN ↗
    [delayed]
  3. plorkyeran · 1790691883 · focus · HN ↗
    Apple has had various forms of iCloud sync that theoretically compete with firebase but are really awful for the entire life of firebase.
Skwid · 1790672984 · focus · HN ↗
I'm hearing an awful lot of "How could they do this to us?" and not a lot of "Wow, maybe we should have read some of this 3rd party code we bundled into 'ALLLL' of our apps"
Just an ignorant and naive outsider's take, but to me it paints a pretty damning picture of the state of mobile development.
1. freakynit · 1790673097 · focus · HN ↗
  Mobile and frontend development, both, now-a-days contain way way way more dependencies than they should.
  1. pranshuchittora · 1790674781 · focus · HN ↗
    Yes, but the SaaS adoption is also the reason. Many analytics SDKs, observability tooling etc.
2. applfanboysbgon · 1790673202 · focus · HN ↗
  I'm normally right there with you, but Firebase is mandatory for Google Play integration, ie. sending push notifications to users. This is as much an indictment of the duopoly's iron grip on the most widely used computing platform in the world as it is individual developers.
3. skeledrew · 1790674419 · focus · HN ↗
  > maybe we should have read some of this 3rd party code we bundled
  Not really practical though, if you push the thought to its limit. That 3rd party code is literally everything that's not written by you, from firmware to the launch UI. And if you don't push the thought to the limit then there's always that risk leading to the same "maybe we should've read X" if something happens in X. Trusting that others will be good stewards of all that 3rd party stuff is a hard requirement for making progress.
  1. alt227 · 1790675451 · focus · HN ↗
    I agree its not practical, but including any 3rd party libraries in your project puts it at real risk of upstream bugs. There needs to be acceptance of this rather than blame culture.
  2. Skwid · 1790683250 · focus · HN ↗
    I appreciate what you're saying. Commercial realities are very different to theoretical ideals, and of course you have to draw the boundary of trust somewhere to get anything done.
    I don't think anyone is saying it's an app developers responsibility to ensure the user's bootloader is securely implemented.
    There is a lot of space between verify everything and trust nothing, and I don't think it's unreasonable to question whether that trust boundary is in the right place.
    I also think that the code compiled to produce the binary you ship is a perfectly reasonable place to put that boundary, would you disagree?
    I'm sure that within the mobile dev world it is normal, accepted practice to include lots of unseen code. I don't begrudge anyone involve for taking the money and doing what's expected.
    But I still think it's a mad way to run a business or community project, and it's worth considering how we got here and whether it really has to be this way.
4. bcye · 1790674823 · focus · HN ↗
  You're already trusting them with their proprietary cloud products, whose code you can't read. Why wouldn't you trust them with their client SDK code.
  1. jeroenhd · 1790675260 · focus · HN ↗
    Because their client SDK might crash the entire app if the server does something funky. We saw it before with Facebook, and now it's Firebase's turn.
    A dependency on code you can't read reaching out to servers you don't control is a recipe for disaster. If you can control the server, you can try to add fixes, redirect DNS to a backup cluster, you name it. If you implement the client, you can write the code in a way that doesn't cause full crashes when the remote server does something weird. If you can do neither, you're handing over your business flow and uptime to a third party that doesn't care about you in the slightest.
    bcye · 1790701437 · focus · HN ↗
    Well your database crashing isn't much better for your uptime really
5. whstl · 1790692228 · focus · HN ↗
  > state of mobile development
  If only it was just mobile development.
alex_suzuki · 1790673037 · focus · HN ↗
I remember first learning about Firebase when working on Android push notifications, a loooooong time ago (~2011 i think). Over time it grew into this full-featured app development platform, after an aquisition (don’t remember the name).
These days however it feels a bit neglected, and somehow poorly bolted on to GCP. I still have a few production apps running on it and news like this reinforces my belief that it’s in decline.
What are folks using these days that (ideally) is open source and self-hostable? I don’t want to lock in with another platform. Some of these apps use the offline sync feature of Firestore (apps used in basements and other low-connectivity areas).
1. teoruiz · 1790674046 · focus · HN ↗
  [delayed]
  1. alex_suzuki · 1790677038 · focus · HN ↗
    I wasn't aware that Supabase is self-hostable - thanks for pointing that out, will have a look. Customer is in Europe, if they decide to move away from Firebase, they don't want to migrate to another managed platform run by a US company (digital sovereignty etc.)
2. bcye · 1790674647 · focus · HN ↗
  Especially for offline sync Firebase is still much stronger than other all-in-one solutions.
  The real alternative there would be to use some SQLite syncing solution and a different solution for auth and cloud compute.
  1. matharmin · 1790676579 · focus · HN ↗
    While Firebase has support for queries with realtime updates and offline caching, I wouldn't quite call it offline sync.
3. pranshuchittora · 1790674943 · focus · HN ↗
  Yes that's the sad part, if you want to integrate Push Notification in your app, and you want to use a 3rd party vendor like OneSignal etc, you still need a fuckin FIREBASE account & FIREBASE dependencies in your app. So every app on the Play Store comes with firebase dependency.
  1. hackernud3s · 1790677064 · focus · HN ↗
    Calling them a 3rd party push notification vendor is being generous. Google is still doing the push notification and I guess OneSignal offers a wrapper around the libs.
    pranshuchittora · 1790695146 · focus · HN ↗
    Yes, so basically all Android devices comes with Play Services that's why we need firebase. But in regions like China they have their own Play Services alternative and inorder to send notifications to those devices OneSignal or others provides a unified wrapper.
  2. mcsniff · 1790705228 · focus · HN ↗
    Er no?
    Be hyperbolic if you want, but there are LOTS of apps on the Play Store that do not have internet access, let alone a dependency on Firebase.
    Rygian · 1790717793 · focus · HN ↗
    With push notifications?
4. ryan_beethe · 1790683099 · focus · HN ↗
  I'm working on an alternative (phaselock.io) which is still in alpha but it is open-source and self-hostable.
  Offline mode and cross-platform support are some of the features most important to me.
5. Leonard_of_Q · 1790684120 · focus · HN ↗
  Using UnifiedPush with ntfy [1] as push distributor, used Prosody as well with Conversations as distributor which did work but I prefer ntfy because it does its one thing well.
  [1] <a href="https://github.com/binwiederhier/ntfy" rel="nofollow">https://github.com/binwiederhier/ntfy
6. wilsynet · 1790692959 · focus · HN ↗
  I was a new employee at Google when we started talking to Firebase. The founders are super smart and get stuff done.
  However, I remember saying to the VP who was leading the acquisition, “shouldn’t we decide what market we want to be in, then evaluate if we should build, buy, or partner?”
  He said “no, we should buy it first then figure out what to do”.
  I’m not surprised Firebase feels like it’s bolted on. They never really knew what they wanted to do with it. That was true then and it’s true now.
nasretdinov · 1790673388 · focus · HN ↗
If only there was any way to avoid this, right..? (I don't mean from Google's side, that as well, but that's not the point)
1. pranshuchittora · 1790675625 · focus · HN ↗
  No, not under your control. It is like "trust me bro" thing from your dependency maintainers.
  1. nasretdinov · 1790678722 · focus · HN ↗
    Well, you don't have to use the proprietary third-party SDKs in your apps... If you want analytics you can either implement your own, or use some open-source ones that aren't dependent on some third party backends switching some features on for everyone all at once...
rvz · 1790673575 · focus · HN ↗
Keep vibe coding and breaking everything.
This will be the new normal as all human “engineers” from staff to seniors are now down levelled to interns and junior engineers when using AI; unable to understand what they are doing and pushing broken updates like this into production with “agents”.
Better not blame Claude on this outage.
1. pranshuchittora · 1790674988 · focus · HN ↗
  No matter who writes the code, the name in the commit is responsible as well as the person who approved / reviewed the PR.
  1. swiftcoder · 1790675380 · focus · HN ↗
    The coding side of this isn't even the problem - that a broken change like this made it to production is an operational failure.
    Why didn't testing catch this? Why was there no canary? How come alarms didn't wake up an on call as soon as the call-volume on the backend dropped? Why was this update rolled out to every customer at once, instead of gradually?
    pranshuchittora · 1790675518 · focus · HN ↗
    I think verification is still a grey area in the agentic software dev. QA and ppl testing it often resort to coding agents for the QA work, and we all know how good agents are at convincing themselves.
    pranshuchittora · 1790675551 · focus · HN ↗
    Btw, I am currently working towards solving the QA and verification @ <a href="https://vostride.com/" rel="nofollow">https://vostride.com/
    2muchcoffeeman · 1790676855 · focus · HN ↗
    The solution is testing it yourself, not more AI
    gib444 · 1790676189 · focus · HN ↗
    [delayed]
  2. lelanthran · 1790677098 · focus · HN ↗
    No matter how many times this is said, the reality is that it is not true: no one will get blamed if the AI can be blamed.
    darkwater · 1790678221 · focus · HN ↗
    Wrong. They will be totally blamed. And the pushback will be that management forced me to use AI and go fast. Then, management will be the one NOT being blamed for this.
  3. Macha · 1790677699 · focus · HN ↗
    And in many companies, if they move at a responsible speed (rather than the speed the AI vendors promise, if you let their tools work in yolo mode), that person will get replaced by someone who will just yolo it
  4. fernandotakai · 1790680323 · focus · HN ↗
    there's a LOT of push from vibecoders to stop with PR reviews.
    i've also heard "the prompt is the only thing that should be reviewed"
  5. PunchyHamster · 1790681581 · focus · HN ↗
    Just blaming AI seems to be the norm now, we have companies literally hacking other companies by "rogue LLM" and not getting any responsibility for it
2. phoghed · 1790679220 · focus · HN ↗
  <a href="https://news.ycombinator.com/item?id=23097459">https://news.ycombinator.com/item?id=23097459
  1. rvz · 1790682197 · focus · HN ↗
    So we have not learned anything since then, on both sides from the SDK builder side and the client side.
    Why is it that iOS is crashing but not Android?
    Google should know better to not have such an incident like this as the Firebase SDK runs on millions of apps.
    If you did not implement a fall back mechanism, perhaps you based your testing assumptions on that “Firebase could never crash my app” which is now false.
hzwanip · 1790674188 · focus · HN ↗
At least Google engineers can invert a binary tree
1. pranshuchittora · 1790674539 · focus · HN ↗
  Lol, but they can't build BREW ;)
2. devsda · 1790677461 · focus · HN ↗
  Yeah, surely atleast 12 of those engineers tested their SDK thoroughly for a minimum of 14 continuous days. /s
  1. pranshuchittora · 1790695056 · focus · HN ↗
    I can understand the pain as an indie dev ;(
3. vdfs · 1790678946 · focus · HN ↗
  Don't underestimate them, can also crash linux/plasma <a href="https://news.ycombinator.com/item?id=49849626">https://news.ycombinator.com/item?id=49849626
4. sam_lowry_ · 1790679848 · focus · HN ↗
  What happened to all the leather jacket boys from Google? They were setting the trends in Site Reliability Engineering some 10 years ago.
  See this 2016 article for the cultural background: <a href="https://cloud.google.com/blog/products/gcp/adventures-in-sre-land-welcome-to-google-mission-control" rel="nofollow">https://cloud.google.com/blog/products/gcp/adventures-in-sre...
  1. Citizen_Lame · 1790680506 · focus · HN ↗
    Bean counters took over, now it's maximum profit extraction until slow decline takes over. Decline in profit mind you, their software and service quality took a dive a while ago.
    someonebaggy · 1790693235 · focus · HN ↗
    It was bean counters in 2016 too
    sam_lowry_ · 1790696261 · focus · HN ↗
    They did get leather jackets in 2016, no?
  2. svict4 · 1790713430 · focus · HN ↗
    They're all reading from the new AI SRE book <a href="https://sre.google/resources/practices-and-processes/ai-engineering-reliable-operations/" rel="nofollow">https://sre.google/resources/practices-and-processes/ai-engi...
5. pjmlp · 1790687361 · focus · HN ↗
  Yeah, but better not spend too much time reading AOSP source code.
GnosiWorks · 1790674521 · focus · HN ↗
[dead]
hnisjafx40 · 1790675729 · focus · HN ↗
Yeah, and pinning versions doesn't save you when the config comes from their server.
saagarjha · 1790676717 · focus · HN ↗
Ironic. They could save others from crashes, but not themselves.
redwood · 1790677661 · focus · HN ↗
A friendly piece of vocabulary assistance: it's "this morning" ("today morning" is not correct English)
1. deergomoo · 1790678653 · focus · HN ↗
  It’s a common phrase in Indian English
  1. redwood · 1790688458 · focus · HN ↗
    That's true. It's one of those phrases that, for example in an interview, an Indian might not be aware holds them back because of how jarring it sounds to the native speaker. My feeling is that while it's true it's effectively colloquial English in the subcontinent it's also appreciated if people understand rather than everyone being too polite to say anything and never coach the person. Well I'm here I will admit I love you the words thrice and the needful
jaen · 1790677861 · focus · HN ↗
Exactly the same thing also happened in 2020 with the Facebook SDK: <a href="https://news.ycombinator.com/item?id=23097459">https://news.ycombinator.com/item?id=23097459
frizlab · 1790679533 · focus · HN ↗
All iOS apps that are using firebase… It’s an important distinction.
1. saghm · 1790688582 · focus · HN ↗
  Important but also pretty obvious. If literally every iOS app were crashing, I would expect a more generic headline from a major news outlet, not a tweet discussing the cause with ALLLLLL CAPS in the middle of it.
elzbardico · 1790681121 · focus · HN ↗
The more we insist on the idiotic idea that we can delegate all coding to agents and don't even need to read it anymore, the more such things will happen. And they will accelerate, as the hidden errors will compound.
macsentinel · 1790681154 · focus · HN ↗
[dead]

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.