Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom’s Use of Facebook’s SDK in iOS Client

blog.zoom.us

Post reply on HN
Print view View original

21–30 of 272 posts

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#21

Post by ricardobeat »

proactivesvcs wrote: post #20

If Zoom "takes its users' privacy extremely seriously" and their "customers’ privacy is incredibly important" then why would they be releasing software without a strong knowledge of what third party code they're adding in, and what exfiltration might be happening as a result? They hold user privacy in such high regard and yet are releasing a program without even hooking it up to a network monitor for five minutes? So…

This is absolutely common. Business will require tracking/authentication/etc, contracts will be signed, developers will implement the provided SDK. Nobody will inspect the data being sent.

> releasing a program without even hooking it up to a network monitor for five minutes

How many times have you seen anyone do that? Unfortunately that is the reality - my personal take is to simply try to avoid vendor libraries at all costs, but it's hard to sell.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#23

Post by noahtallen »

shbooms wrote: post #19

Headline should technically read: "Zoom Removes Code That Sends Data to Facebook when you first open the app" as per the article: "Motherboard downloaded the update and verified that it does not send data to Facebook upon opening." It's a bit naive to just assume that just because they don't send the data right away, that it's not getting sent at some point later on.

> we decided to remove the Facebook SDK in our iOS client and have reconfigured the feature so that users will still be able to log in with Facebook via their browser.

Since they removed the Facebook SDK entirely, whatever mechanism Facebook used to collect the info doesn’t exist any more. Instead of being able to collect the data at all times, wouldn’t FB only have a vector to do so through web login? At that point, I assume they could do fingerprinting in the browser to collect some info, but at least the cannot do it on the system level any more.

It still seems like this is a big improvement. Though, I imagine most folks will have at least one other app using the FB SDK, so it’s not like the root cause is fixed.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#24

Post by mroche »

starmftronajoll wrote: post #13
mroche wrote: post #7

Earlier quoted context omitted.

From the article: > Motherboard downloaded the update and verified that it does not send data to Facebook upon opening. Edit: Fixing mental hiccup, nothing to see here.

This is the new article from Motherboard. Motherboard = Vice

Now I feel dumb. I completely forgot that connection, and skipped over the blatant “Motherboard, Tech by Vice” in the title. It’s been a long week...

Don’t mind me, just fixing that mistake.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#25

Post by anonu »

I noticed today that the mic was "muted" on zoom. I chimed in on the video call I was on and the window flashed a reminder that I was "muted".

So clearly the mic itself is not muted - the software is still listening.

Not sure how I felt about that given all the recent Zoom privacy revelations.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#26

Post by dilly_li »

ricardobeat wrote: post #21
proactivesvcs wrote: post #20

If Zoom "takes its users' privacy extremely seriously" and their "customers’ privacy is incredibly important" then why would they be releasing software without a strong knowledge of what third party code they're adding in, and what exfiltration might be happening as a result? They hold user privacy in such high regard and yet are releasing a program without even hooking it up to a network monitor for five minutes? So…

This is absolutely common. Business will require tracking/authentication/etc, contracts will be signed, developers will implement the provided SDK. Nobody will inspect the data being sent. > releasing a program without even hooking it up to a network monitor for five minutes How many times have you seen anyone do that? Unfortunately that is the reality - my personal take is to simply try to avoid vendor libraries at…

This.

Most things are operated in an honor system.

Take npm as another example, in a large corporation, any commercial product that relies on third-party npm packages will have to survive a long legal audit process.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#27

Post by dx87 »

It's good that they removed it, but it's also dissapointing that they had no idea that it was happening until someone made a blog post about it. Do their employees not vet any of the code they use, and just slap things together off the internet and hope it's not doing anything their users don't like?

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#28

Post by gfodor »

ricardobeat wrote: post #21
proactivesvcs wrote: post #20

If Zoom "takes its users' privacy extremely seriously" and their "customers’ privacy is incredibly important" then why would they be releasing software without a strong knowledge of what third party code they're adding in, and what exfiltration might be happening as a result? They hold user privacy in such high regard and yet are releasing a program without even hooking it up to a network monitor for five minutes? So…

This is absolutely common. Business will require tracking/authentication/etc, contracts will be signed, developers will implement the provided SDK. Nobody will inspect the data being sent. > releasing a program without even hooking it up to a network monitor for five minutes How many times have you seen anyone do that? Unfortunately that is the reality - my personal take is to simply try to avoid vendor libraries at…

I guess this is another under-recognized benefit of developing for the web - when doing so, you're staring at the Network tab all day, trying to grok what's going on over the wire and to whom. I don't remember doing this nearly as much on native.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#29

Post by untog »

anonu wrote: post #25

I noticed today that the mic was "muted" on zoom. I chimed in on the video call I was on and the window flashed a reminder that I was "muted". So clearly the mic itself is not muted - the software is still listening. Not sure how I felt about that given all the recent Zoom privacy revelations.

FWIW Google Hangouts/Meet does the same thing. It’s actually a pretty useful feature... as long as you trust the company implementing it, I guess.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#30

Post by klyrs »

anonu wrote: post #25

I noticed today that the mic was "muted" on zoom. I chimed in on the video call I was on and the window flashed a reminder that I was "muted". So clearly the mic itself is not muted - the software is still listening. Not sure how I felt about that given all the recent Zoom privacy revelations.

Yeah, my light's still on when I'm not sharing video and I hate it
Post reply on HN