Live data from Hacker News

Ask HN: Why does Zoom Desktop examine all processes and arguments?

news.ycombinator.com

241–250 of 277 posts

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#241
post #158

Zoom has attention tracking, which when enabled silently, shows an admin if the screen is maximized or if the user is focused on other applications. They don't yet tell admins what other apps the user is active in, just whether the user is active. Another angle for Zoom to do that, is that it is a massive Chinese spyware application, which can target users by meta data or IP, like it did by messing with the calls of…

That feature got pulled last year and hasn't existed for over a year and a half now.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#242

Earlier quoted context omitted.

The issue is that this model heralds from the 60s when such problems weren't even considered.

That is a way to see it. I see it differently, for me the main issue is the fact that people run random software that were not even vetted. If you dnf/apt install everything from the official repos of your distro, you wont have any misbehaving apps. And that model still holds. And as I explained, other security models don't work either. People will just whitelist the app, or click "Accept" anyway, because they want t…

> And as I explained, other security models don't work either. People will just whitelist the app, or click "Accept" anyway, because they want the feature now! What's the point of nagging with a modal window "your random app, that you installed from a random website on the internet, which means you really want to use this specific app, is behaving in a shady manner, are you okay with this?"

At least they get the choice? If they need something so badly they're happy to give it whatever permissions, fine, but at least they're aware and consented.

I don't know why you think nobody ever would decline, I and I assume many people do on mobile devices. Especially now that more recent (Android anyway) versions allow/require a sort of 'progressive' acquiring of permissions, prompt when it's needed and not before.

Apple & Google clearly think some people want to decline some of the time (and enough that it should be an option), or at least that it's a good way to deliver awareness.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#243
post #136

It not only examines all processes and arguments - it leverages the microphone to act on ultrasonic cues for "integrations". Zoom is a privacy dumpster fire. https://devforum.zoom.us/t/ultrasonic-connection/3318

It also plays your user-name (when configured by the meeting owner) in the background at a non-audible frequency, so that companies can find out who leaked their meetings by analysing the audio from the leak. https://theintercept.com/2021/01/18/leak-zoom-meeting/

Thanks a lot, its now fully trollable.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#244

Earlier quoted context omitted.

Hence “unlikely stretch.”

Let's just say the quiet part outloud: they sell that data.

Haha. What possible market is there for knowing which other binaries Zoom (desktop) users run? OMG Zoom users also run Chrome, cat, and init! That'll be $10k please.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#245

Earlier quoted context omitted.

I literally quit all messaging apps when presenting to people for any period of time more than ~10s.

You could also disable notifications if your OS has that kind of feature. Mine does, so I took advantage of that after the first incident of being interrupted. It's a nice feature.

Let me introduce you to Microsoft Teams which comes with custom notifications ignoring do-not-disturb settings.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#247
post #133

Earlier quoted context omitted.

>The audio and video quality, ... is much better in the desktop app But is the quality actually better, or is it post-processing tricks to make it seem better on commodity hardware/audio setups? If it is actually better, surely this should be measurable and there should exist evidence to support such a claim.

> is the quality actually better, or is it post-processing tricks to make it seem better Serious question - if the experience is the same, why does this distinction matter?

Because if I have good hardware the post-processing isn't going to make it sound any better, I'm better off with the source.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#248

Earlier quoted context omitted.

I believe they mean grab the absolute path to the real executable, run ldd against it, and parse that output to see if it links against libX11. That doesn't tell you a program is really using X11, though, as plenty have some sort of no-gui option to launch without a window. You can always cat /proc/{PID}/maps to see if libx11 is actually loaded into the process' address space, and just use readlink on exe to figure o…

Do you have evidence of old being executed or similar? The posted strace log section is fairly benign and shows no hints of what you insinuate.

Nope, and I'm not going to run zoom to find out. To be perfectly clear, I'm not at all trying to say I have evidence that this is what zoom is actually doing. I'm trying to say I believe this is what the upper-level post was suggesting zoom is doing.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#249

Earlier quoted context omitted.

That is a way to see it. I see it differently, for me the main issue is the fact that people run random software that were not even vetted. If you dnf/apt install everything from the official repos of your distro, you wont have any misbehaving apps. And that model still holds. And as I explained, other security models don't work either. People will just whitelist the app, or click "Accept" anyway, because they want t…

If you dnf/apt install everything from the official repos of your distro, you wont have any misbehaving apps. And that model still holds. How do you know this? I hear this a lot, I've built packages myself, only because I needed them in a hurry. I never really went through the source code to make sure it's safe. Maybe others did, but I didn't, people installed the package, maybe they were hacked, who knows? Just sayi…

When a package lands in Debian Sid or in Fedora Rawhide, there is a group/subculture of nerds who like to inspect it and report any misbehaviour. [1] [2]

I usually do this directly on the source project, but some people in this subculture do it in their distro.

Also I'm surprised your packages landed in Debian/Fedora, because there is a review process… I'm not talking about a ppa repo or a copr repo, anybody can run that. I'm talking about packages in the official repositories. Installing software from a random ppa or copr repo is the same as curl | sudo sh, nobody vetted this.

[1] Type of bugs they report: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=792580

[2] https://www.fsf.org/blogs/community/who-actually-reads-the-c...

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#250

Zoom has a popular feature which allows for screen sharing a single application window instead of the entire desktop. I assume this is how its discovering running applications with GUI windows open in a cross-platform manner. Perhaps there is a better API for this? Its not a common use-case that an app would need to know all of the other open windows, but it seems like a perfectly valid use case, and frankly handy fo…

I'm pretty sure Jitsi allows for screen-sharing a particular application so I'm curious to know how that works. Might check the source later.
Post reply on HN