Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zoom’s Use of Facebook’s SDK in iOS Client

blog.zoom.us

Post reply on HN
Print view View original

71–80 of 272 posts

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#71

Post by floatingatoll »

intopieces wrote: post #55
mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

>Getting mad at Zoom for using the Facebook SDK is missing the point. It's really hard to believe this point given that... getting mad seems to have worked.

No, raising widespread awareness seems to have worked. Getting mad reduces the chances of someone responding usefully.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#72

Post by yjftsjthsd-h »

mgoblu3 wrote: post #50
xiphias2 wrote: post #47

Earlier quoted context omitted.

Actually Apple and Google should not allow this in their app store policy. An 3rd party SDK sending data if it’s not needed should be a BIG no-no....I expect at least Apple to require this. There are probably thousands of other apps that have the same problem.

Would be pretty hard to scan for, but I agree that there should be something at least outlined. Privacy policies clearly are aren’t useful enough.

Hard in the general case, but I'll bet it's trivial to scan for the Facebook SDK, or any other blacklisted libraries, unless they're intentionally obfuscated.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#73

Post by floatingatoll »

nh2 wrote: post #56
pyt wrote: post #32

I contacted LG last month regarding their use of the Facebook SDK's automatic event collection in their ThinQ Android app. They responded and told me that they're disabling it in an upcoming release (incidentally, today's). If a single email is all it took to get a company with over $50 billion in revenue to disable Facebook's tracking in one of their apps, I really don't think that these companies are sharing data i…

> I don't think these companies are sharing data with Facebook intentionally. That would imply they are incompetent and negligent. Would one not expect large companies like LG to have internal security and privacy reviews of the software they publish, and know very well what they are doing? > What justification Their core business.

Given Google's hostility towards the glacier-slow release schedules of Android updates and the continued embedding of vendor apps that screw up Android by phone vendors such as LG, I'm already quite biased in favor of "companies like LG are incompetent and negligent", based on the evidence available over the past several years.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#74

Post by yjftsjthsd-h »

designcode wrote: post #60
narendranag wrote: post #51

Considering how many apps are using Facebook's SDK, shouldn't this be something that FB should be addressing? After all, they are the ones making an SDK available to app developers to help with user-login. Shouldn't the presumption of trust rest on FB?

I can’t see the big deal. We use the Facebook SDK specifically for the free analytics. It’s just a default part of the SDK. It’s not sending anything any other analytics package wouldn’t

> It’s not sending anything any other analytics package wouldn’t

But the where matters as much at the what; sending it to FB means that they add it to their profile of your users.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#75

Post by kelnos »

nh2 wrote: post #56
pyt wrote: post #32

I contacted LG last month regarding their use of the Facebook SDK's automatic event collection in their ThinQ Android app. They responded and told me that they're disabling it in an upcoming release (incidentally, today's). If a single email is all it took to get a company with over $50 billion in revenue to disable Facebook's tracking in one of their apps, I really don't think that these companies are sharing data i…

> I don't think these companies are sharing data with Facebook intentionally. That would imply they are incompetent and negligent. Would one not expect large companies like LG to have internal security and privacy reviews of the software they publish, and know very well what they are doing? > What justification Their core business.

> That would imply they are incompetent and negligent.

Not really.

Product Manager: I want to be able to support Facebook login for our app.

Developer: OK... [googles for how to do that] ... We can use the FB SDK for that.

PM: Cool, let's do that.

Dev: [implements it]

Nobody really does much more due diligence than that most of the time. I suppose you could argue that's negligent, but if that's the case, then pretty much every company that has an app with login functionality is probably in that boat.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#76

Post by shakna »

jbigelow76 wrote: post #66
JMTQp8lwXL wrote: post #57

Earlier quoted context omitted.

Seeing it != blocking it.

If you can see it you can make an informed choice if the tradeoff is worth it.

If you can see it, but can't block it, then you've already lost a part of it before you can make that informed decision.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#77

Post by kelnos »

dx87 wrote: post #27

It's good that they removed it, but it's also dissapointing that they had no idea that it was happening until someone made a blog post about it. Do their employees not vet any of the code they use, and just slap things together off the internet and hope it's not doing anything their users don't like?

> Do their employees not vet any of the code they use, and just slap things together off the internet

That sounds like a pretty accurate description of how software is built. (No, I'm not being flippant.)

> ... and hope it's not doing anything their users don't like?

I expect most don't think too much about it, not out of malice, but because their product manager told them "I want FB login" and to do that, they either spend an afternoon using the FB SDK, or spend a week figuring out how it works, implementing it from scratch themselves, and debugging the inevitable interop issues with whatever oauth2 (or whatever) library they've picked. It's really a no-brainer... few developers can take the week-long route and then justify that to their manager. They'll get fired.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#78

Post by kelnos »

banana_giraffe wrote: post #38
dx87 wrote: post #27

It's good that they removed it, but it's also dissapointing that they had no idea that it was happening until someone made a blog post about it. Do their employees not vet any of the code they use, and just slap things together off the internet and hope it's not doing anything their users don't like?

Between this and the HTTP server, it feels like Zoom of old that wrote the app was more willing to make the user experience vs user privacy trade off in favor of user experience. Now you need to log in via Facebook with a separate browser window, and thanks to the HTTP change, you need to click on a browser dialog to launch a meeting from a link. So, they've either changed their policy to err more towards the privacy…

I think it's more likely that the developers responsible for the HTTP server just didn't know much about local security, and Zoom doesn't have a good security review process (where actual infosec professionals are involved). That doesn't absolve them of responsibility, of course, but I really don't think it was malice or an intentional desire to ignore privacy concerns.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#79

Post by kelnos »

gfodor wrote: post #28
ricardobeat wrote: post #21

Earlier quoted context omitted.

This is absolutely common. Business will require tracking/authentication/etc, contracts will be signed, developers will implement the provided SDK. Nobody will inspect the data being sent. > releasing a program without even hooking it up to a network monitor for five minutes How many times have you seen anyone do that? Unfortunately that is the reality - my personal take is to simply try to avoid vendor libraries at…

I guess this is another under-recognized benefit of developing for the web - when doing so, you're staring at the Network tab all day, trying to grok what's going on over the wire and to whom. I don't remember doing this nearly as much on native.

Yeah, that's the thing. I do very little web development, but I inevitably find myself in the Network tab of dev tools debugging something. I do around as little mobile (Android) development, and I'm not even really sure how I'd watch network traffic coming from an Android app. (I'm sure it's possible, but I imagine it requires explicit setup, possibly with some third-party software and/or the assistance of a laptop.)

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#80

Post by crtlaltdel »

mikenew wrote: post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

yeah same here, on web and mobile this is super common. i just went through this with a PM.
Post reply on HN