41–50 of 272 posts
It's good that they removed it, but it's also dissapointing that they had no idea that it was happening until someone made a blog post about it. Do their employees not vet any of the code they use, and just slap things together off the internet and hope it's not doing anything their users don't like?
That is ridiculous that a company as big as Zoom wouldn't know what an API they're using is doing with their customer's data. Is there not a legal/privacy team at Zoom that is in charge of reading all the fine prints and license agreements??
For me this would be much stranger at a tiny company.
It's good that they removed it, but it's also dissapointing that they had no idea that it was happening until someone made a blog post about it. Do their employees not vet any of the code they use, and just slap things together off the internet and hope it's not doing anything their users don't like?
"It's good that they removed it, and it goes to show just how important it is to inspect your application's wire traffic as part of your development and testing processes. Otherwise you'll have no idea what's happening until someone makes a blog post about it."
Headline should technically read: "Zoom Removes Code That Sends Data to Facebook when you first open the app" as per the article: "Motherboard downloaded the update and verified that it does not send data to Facebook upon opening." It's a bit naive to just assume that just because they don't send the data right away, that it's not getting sent at some point later on.
> we decided to remove the Facebook SDK in our iOS client and have reconfigured the feature so that users will still be able to log in with Facebook via their browser. Since they removed the Facebook SDK entirely, whatever mechanism Facebook used to collect the info doesn’t exist any more. Instead of being able to collect the data at all times, wouldn’t FB only have a vector to do so through web login? At that point,…
I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with.
Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone. Or having no way to package open source software where you can actually see what's running. As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about.
Yeah maybe you can pass laws about it. But is that really a great solution? Who audits that? How do you determine what's legal and what's not? We should be pushing for a platform that makes it obvious what the software you're running is up to. The random pitchfork crusade against whatever company happens to catch a bad news cycle just isn't going to get us anywhere.
It's good that they removed it, but it's also dissapointing that they had no idea that it was happening until someone made a blog post about it. Do their employees not vet any of the code they use, and just slap things together off the internet and hope it's not doing anything their users don't like?
It’s the official SDK of one of the biggest companies. I can’t fault them on not catching this. What Facebook does is ugly.
I really can't fault Zoom here. They used an existing tool provided by a company that is, allegedly, reputable.
Though, thinking about it more perhaps Zoom should get some more scrutiny here because this isn't the first time Facebook has said eff it to user privacy. Distrust of Facebook should be the default.
Earlier quoted context omitted.
It’s the official SDK of one of the biggest companies. I can’t fault them on not catching this. What Facebook does is ugly.
Yeah, this. I really can't fault Zoom here. They used an existing tool provided by a company that is, allegedly, reputable. Though, thinking about it more perhaps Zoom should get some more scrutiny here because this isn't the first time Facebook has said eff it to user privacy. Distrust of Facebook should be the default.
There are probably thousands of other apps that have the same problem.
Earlier quoted context omitted.
Yeah, this. I really can't fault Zoom here. They used an existing tool provided by a company that is, allegedly, reputable. Though, thinking about it more perhaps Zoom should get some more scrutiny here because this isn't the first time Facebook has said eff it to user privacy. Distrust of Facebook should be the default.
Actually Apple and Google should not allow this in their app store policy. An 3rd party SDK sending data if it’s not needed should be a BIG no-no....I expect at least Apple to require this. There are probably thousands of other apps that have the same problem.
In the company I worked for, they read the code, you have access to it, and stripped that parts. It's not much work but its a pain.
The best approach is to use just the HTTP APIs and ignore the SDK. Your team will better understand how Facebook works, your app will be lighter and you are free from nasty surprises that a 3rd party may add to your app without your knowledge.
Earlier quoted context omitted.
Yeah, this. I really can't fault Zoom here. They used an existing tool provided by a company that is, allegedly, reputable. Though, thinking about it more perhaps Zoom should get some more scrutiny here because this isn't the first time Facebook has said eff it to user privacy. Distrust of Facebook should be the default.
Actually Apple and Google should not allow this in their app store policy. An 3rd party SDK sending data if it’s not needed should be a BIG no-no....I expect at least Apple to require this. There are probably thousands of other apps that have the same problem.