Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why does Zoom Desktop examine all processes and arguments?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 277 posts

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#91

Post by P9TXJYG0TENG »

andrewlevi wrote: post #75

Does Teams or Discord do anything similar?

Discord does. It makes some sense, since Discord has a feature to broadcast what game you're currently playing (or anything you want), but I found it was scanning /proc even when I turned this off.

I didn't like that, and I spent a lot of time and effort working out various ways to keep it out of /proc (or anywhere else while I was at it- mostly with AppArmor) and ultimately ended up running it in a container with systemd-nspawn. This is still a little bit fiddly, but seems to work reliably and without any issues.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#92

Post by twic »

reilly3000 wrote: post #50

Zoom has a popular feature which allows for screen sharing a single application window instead of the entire desktop. I assume this is how its discovering running applications with GUI windows open in a cross-platform manner. Perhaps there is a better API for this? Its not a common use-case that an app would need to know all of the other open windows, but it seems like a perfectly valid use case, and frankly handy fo…

I run Zoom from flatpak, which runs it in a container, and sandboxes it to some extent [1]

This probably explains why, when i try to screenshare a single application window, not every application shows up! I can share my browser, file manager, and various other things, but not windows for games started by Steam.

[1] I followed these instructions https://www.mayrhofer.eu.org/post/zoom-flatpak-sandboxing/

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#93

Post by gmueckl »

woodruffw wrote: post #70
cranekam wrote: post #65

Earlier quoted context omitted.

There’s nothing in /proc/PID/cmdline etc that would definitely confirm an app has a GUI. The two concepts are at very different layers of the stack — to the OS the GUI is just another app on top of the kernel. Mayyyyyybe Zoom could be doing some crude pattern matching on process name or environment variables of a given process (though it’d only be able to read data of processes running as the same user) but it’s a lo…

This is an unlikely stretch, but it looks like they're also attempting to read `/proc/PID/exe` -- they could be doing something (extremely) cursed like attempting to parse the program linkages and filtering by programs that link to `libX11`. But that's me straining to explain this in the context of the GP's hypothesis.

Nah, the readlink on exe looks like it's simply to query the real name of the executable, so that's pretty benign.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#94

Post by nsomaru »

GekkePrutser wrote: post #79
hdjjhhvvhga wrote: post #63

Earlier quoted context omitted.

I don't understand why anyone who is forced to use it doesn't use it in a browser (I have a separate Firefox container for that, same for Teams).

Does teams work for your in a FF container? For me it always ends up in a redirect loop :( but my work uses MCAS for external computers so that may have to do with it. It's a proxy service from MS that adds some supposed security to their services and makes them even slower.

With containers, subdomains and redirects I’ve found switching off network and forcing each subdomain to open in a particular container 1-by-1 to work well.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#95

Post by lathiat »

P9TXJYG0TENG wrote: post #91
andrewlevi wrote: post #75

Does Teams or Discord do anything similar?

Discord does. It makes some sense, since Discord has a feature to broadcast what game you're currently playing (or anything you want), but I found it was scanning /proc even when I turned this off. I didn't like that, and I spent a lot of time and effort working out various ways to keep it out of /proc (or anywhere else while I was at it- mostly with AppArmor) and ultimately ended up running it in a container with sy…

The discord snap blocks this with apparmor by default unless you connect process-control. But it also fills your kernel log with audit denials.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#96

Post by kelnos »

reilly3000 wrote: post #50

Zoom has a popular feature which allows for screen sharing a single application window instead of the entire desktop. I assume this is how its discovering running applications with GUI windows open in a cross-platform manner. Perhaps there is a better API for this? Its not a common use-case that an app would need to know all of the other open windows, but it seems like a perfectly valid use case, and frankly handy fo…

> I assume this is how its discovering running applications with GUI windows open in a cross-platform manner.

That's definitely not a cross-platform way of doing it (and I doubt there is one, even).

On Linux you'd use libX11 and just enumerate all windows (using XQueryTree()). Walking the contents of /proc is not only unnecessary, but is more difficult to do, as looking at executable names won't tell you if a program has a GUI, or if it has any open windows. It won't give you window titles, or how many windows are open, or how to grab their contents.

Pretty sure Zoom is snooping on us and is gathering telemetry.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#98

Post by propogandist »

thrower123 wrote: post #83
woodruffw wrote: post #70

Earlier quoted context omitted.

This is an unlikely stretch, but it looks like they're also attempting to read `/proc/PID/exe` -- they could be doing something (extremely) cursed like attempting to parse the program linkages and filtering by programs that link to `libX11`. But that's me straining to explain this in the context of the GP's hypothesis.

Never attribute to malice what is adequately explained by laziness. I can easily believe somebody just wrote a chunk of naive code that grabbed all the running processes, and it worked, and they moved on.

or it’s spyware, maybe not as bad as a keylogger, but it can be mining your active usage behavior

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#99

Post by meibo »

sniperjzp wrote: post #61
sails wrote: post #56

Earlier quoted context omitted.

Does Teams do this in the same way? They offer the same feature

Not sure about Teams, but Google Meet allow you to share a specific browser tab, I don't know how to implement it without reading all the opened tabs.

There is a JavaScript API that abstracts this, so Google Meet/whatever asked can only read the "final" video stream of what you selected and not everything that's going on, which stays in your local browser.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#100

Post by mwcampbell »

kelnos wrote: post #96
reilly3000 wrote: post #50

Zoom has a popular feature which allows for screen sharing a single application window instead of the entire desktop. I assume this is how its discovering running applications with GUI windows open in a cross-platform manner. Perhaps there is a better API for this? Its not a common use-case that an app would need to know all of the other open windows, but it seems like a perfectly valid use case, and frankly handy fo…

> I assume this is how its discovering running applications with GUI windows open in a cross-platform manner. That's definitely not a cross-platform way of doing it (and I doubt there is one, even). On Linux you'd use libX11 and just enumerate all windows (using XQueryTree()). Walking the contents of /proc is not only unnecessary, but is more difficult to do, as looking at executable names won't tell you if a program…

> Pretty sure Zoom is snooping on us and is gathering telemetry.

Don't forget Hanlon's razor, as someone else in the thread pointed out.

Post reply on HN