Zoom has a paid feature to view processes of other meeting attendees. Yes. Scary.
I don't believe that, would be way too scary. Do you have a link?
Ask HN: Why does Zoom Desktop examine all processes and arguments?
121–130 of 277 posts
Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?
#122Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?
#123Earlier quoted context omitted.
I don't understand why anyone who is forced to use it doesn't use it in a browser (I have a separate Firefox container for that, same for Teams).
The people here who are saying "Teams and Meet are just as good" are the people who use Zoom in a browser. The audio and video quality, and resilience to poor connections, is much better in the desktop app.
>The audio and video quality, ... is much better in the desktop app
But is the quality actually better, or is it post-processing tricks to make it seem better on commodity hardware/audio setups? If it is actually better, surely this should be measurable and there should exist evidence to support such a claim.
Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?
#124Zoom has a popular feature which allows for screen sharing a single application window instead of the entire desktop. I assume this is how its discovering running applications with GUI windows open in a cross-platform manner. Perhaps there is a better API for this? Its not a common use-case that an app would need to know all of the other open windows, but it seems like a perfectly valid use case, and frankly handy fo…
I run Zoom from flatpak, which runs it in a container, and sandboxes it to some extent [1] This probably explains why, when i try to screenshare a single application window, not every application shows up! I can share my browser, file manager, and various other things, but not windows for games started by Steam. [1] I followed these instructions https://www.mayrhofer.eu.org/post/zoom-flatpak-sandboxing/
Are you using Wayland? That might be an artifact of Steam and games running via XWayland.
Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?
#125Earlier quoted context omitted.
This is an unlikely stretch, but it looks like they're also attempting to read `/proc/PID/exe` -- they could be doing something (extremely) cursed like attempting to parse the program linkages and filtering by programs that link to `libX11`. But that's me straining to explain this in the context of the GP's hypothesis.
Never attribute to malice what is adequately explained by laziness. I can easily believe somebody just wrote a chunk of naive code that grabbed all the running processes, and it worked, and they moved on.
I can easily believe either. However, while the default assumption of laziness/incompetence works well for good faith discussions, it also provides cover for malicious actors. At some point, even though any given actor is likely to be non-malicious, there is no way to distinguish them from the malicious actors.
Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?
#126Earlier quoted context omitted.
This is an unlikely stretch, but it looks like they're also attempting to read `/proc/PID/exe` -- they could be doing something (extremely) cursed like attempting to parse the program linkages and filtering by programs that link to `libX11`. But that's me straining to explain this in the context of the GP's hypothesis.
Nah, the readlink on exe looks like it's simply to query the real name of the executable, so that's pretty benign.
I believe they mean grab the absolute path to the real executable, run ldd against it, and parse that output to see if it links against libX11. That doesn't tell you a program is really using X11, though, as plenty have some sort of no-gui option to launch without a window. You can always cat /proc/{PID}/maps to see if libx11 is actually loaded into the process' address space, and just use readlink on exe to figure out the application name.
That's a really stupid way to figure out if a program has a window, though, compared to just using the X11 API directly.
Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?
#127Zoom has a paid feature to view processes of other meeting attendees. Yes. Scary.
This seems to be a viral inaccuracy: https://www.howtogeek.com/664624/does-zoom-really-monitor-wh...
That article claims that Zoom does have a feature allowing hosts to see whether people have the zoom window focused while someone is presenting, but it doesn't allow the host to actually see running processes. Note that I can't, nor do I claim to, vouch for the accuracy of the explanation in the link. Just something I found.
Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?
#128> Is there any way to prevent it? Mounting /proc with " hidepid=2 " should prevent it from seeing processes owned by other users, although it would still be able to see your processes. Alternatively, it shouldn't be too hard to create an AppArmor profile that blocks access to /proc. Other options might include things like SELinux, seccomp-bpf, namespaces, cgroups, etc., depending on what's available on your host. Or…
You can edit /usr/share/applications/Zoom.desktop to run inside of bubblewrap, similar to how the Arch Wiki suggests doing this for Skype: https://wiki.archlinux.org/title/Bubblewrap#Skype_for_Linux
Since this puts it in its own PID and mount namespace, it won't see any processes except itself and its children. You can even try not mounting /proc in the container this makes at all and see what happens.
This is effectively what flatpak does, but doing it yourself doesn't require installing flatpak.
Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?
#129Perhaps a better question to ask would be "why is any process allowed to do this by default in 2021?"
Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?
#130Earlier quoted context omitted.
This could be verified by inspecting their analytics requests. If I have time I may take a peek at those later.
whoever does the analysis may also become a whistleblower.
Does "whistleblower" apply to people not working directly for the company being reported? I've always understood it to be employee reporting against the employer. I could totally be limiting it from what other people use it though.