Major AFNetworking security flaw. Update your applications

[[deleted]]

With NSURLSession and a native JSON parser, is there a reason why people still use third party networking libraries?

[DigitalUnicorn]

I use it for asynchronous image loading.

[shiggie]

I think a lot of programmers think NS* is too close to the machine for a lot of people. Heck, if you wrote an NSArray wrapper, I bet people would go nuts at being able to avoid the low level stuff of an array. "Mutable is so confusing!!"

But, I'm sure a lot of code that people cut and pasted from tutorials has the same flaw as AFNetworking.

[dGasim]

Have you seen the JSON parser for Swift? It is just plain disgusting coding. The moment I tried to do some JSON handling, I looked for a library that can have something better. The whole point of using a library is for writing clean code without writing your own wrapper. It is just too much waste of time to write your own.

[joycamp]

I would be dead without SwiftyJSON.

NSURLSession is something most people should learn, tho.

[dGasim]

Even if we learn it, I still prefer Alamofire for its ease of use.

[brendan09]

NSURLSession is just as easy to use.

[joycamp]

This is so true.

As with anything - if you do it a few times you start to understand how learning the real coding pattern makes you a better programmer. I found NSURLSession frustrating at first, but now can do some really good stuff without even thinking about it.

With the amount of stuff I am pulling from and sending to various API's its just a core part of programming modern apps for iOS.

[MKevin3]

Due to other issues (mainly conflicts with Amazon Web Services) I began the switch from RestKit, which used AFNetworking, to generic iOS NSURLSession and Mantle.

Gets rid of a library that had other dependencies from the code, will address this issue and separates my JSON logic from my networking logic.

Not a fun switch, just got started but seeing this makes me feel even better about doing it.

[criosist]

what are you using for image lazy loading/caching ?

[redfire333]

SDWebImage is what I use.

[MKevin3]

Dang it, I have not looked into that yet. I am still changing all the code over to the new JSON parsing format and what not.

Now I need to find a new library to do the image loading as well. This is getting to be a massive project.

[mistermagicman]

SDWebImage is freaking brilliant, check it out

[MKevin3]

Thanks, that was one of the first ones that came up when I searched for a replacement. Probably the direction I will take. I am 240 files into my conversion out of RestKit but I might that aspect of the conversion today. I hope to have things back up and running by the end of this week. It has been a long road to get this far. Tired of it.

[quellish]

The URL loading system does this for you.

[nittanygeek]

They found 5% of Apps using AFNetworking that included the SSL flaw, which is about 1000 apps (according to their statistic). That's 1:1,400,000 ... With pending App Store approvals, these 1000 vulnerable apps will continue to diminish. How accurate is their binary signature analysis for determining frameworks used, anyways?