Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why does Zoom Desktop examine all processes and arguments?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 277 posts

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#61

Post by sniperjzp »

sails wrote: post #56
reilly3000 wrote: post #50

Zoom has a popular feature which allows for screen sharing a single application window instead of the entire desktop. I assume this is how its discovering running applications with GUI windows open in a cross-platform manner. Perhaps there is a better API for this? Its not a common use-case that an app would need to know all of the other open windows, but it seems like a perfectly valid use case, and frankly handy fo…

Does Teams do this in the same way? They offer the same feature

Not sure about Teams, but Google Meet allow you to share a specific browser tab, I don't know how to implement it without reading all the opened tabs.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#63

Post by hdjjhhvvhga »

jlgaddis wrote: post #59

> Is there any way to prevent it? Mounting /proc with " hidepid=2 " should prevent it from seeing processes owned by other users, although it would still be able to see your processes. Alternatively, it shouldn't be too hard to create an AppArmor profile that blocks access to /proc. Other options might include things like SELinux, seccomp-bpf, namespaces, cgroups, etc., depending on what's available on your host. Or…

I don't understand why anyone who is forced to use it doesn't use it in a browser (I have a separate Firefox container for that, same for Teams).

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#65

Post by cranekam »

reilly3000 wrote: post #50

Zoom has a popular feature which allows for screen sharing a single application window instead of the entire desktop. I assume this is how its discovering running applications with GUI windows open in a cross-platform manner. Perhaps there is a better API for this? Its not a common use-case that an app would need to know all of the other open windows, but it seems like a perfectly valid use case, and frankly handy fo…

There’s nothing in /proc/PID/cmdline etc that would definitely confirm an app has a GUI. The two concepts are at very different layers of the stack — to the OS the GUI is just another app on top of the kernel. Mayyyyyybe Zoom could be doing some crude pattern matching on process name or environment variables of a given process (though it’d only be able to read data of processes running as the same user) but it’s a long shot.

Personally I’d guess it is either some other library Zoom uses or some kind of debug info capturing system. But I don’t know work at Zoom so who knows.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#66

Post by woodruffw »

reilly3000 wrote: post #50

Zoom has a popular feature which allows for screen sharing a single application window instead of the entire desktop. I assume this is how its discovering running applications with GUI windows open in a cross-platform manner. Perhaps there is a better API for this? Its not a common use-case that an app would need to know all of the other open windows, but it seems like a perfectly valid use case, and frankly handy fo…

Based on OP's snippet they're probably doing this on Linux. Assuming the presence of X11 and an EWMH-compatible window manager, they could query X11 directly and ask the root window for its `_NET_CLIENT_LIST` attribute. That, in turn, would list every "semantic" (i.e., non-decorative) window currently open on the current display.

But that doesn't work for non-X11 or if the WM is non-EWMH compliant. Presumably Wayland has a similar API, and non-EWMH is probably a minuscule group that considers this a desirable feature.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#67

Post by vbernat »

hdjjhhvvhga wrote: post #63
jlgaddis wrote: post #59

> Is there any way to prevent it? Mounting /proc with " hidepid=2 " should prevent it from seeing processes owned by other users, although it would still be able to see your processes. Alternatively, it shouldn't be too hard to create an AppArmor profile that blocks access to /proc. Other options might include things like SELinux, seccomp-bpf, namespaces, cgroups, etc., depending on what's available on your host. Or…

I don't understand why anyone who is forced to use it doesn't use it in a browser (I have a separate Firefox container for that, same for Teams).

For me: more CPU usage (and more battery usage), not able to see other participants when sharing screen.

But I am running Zoom in a Flatpak to avoid the kind of issues reported here. BTW, the same happens with Discord and it's not possible to disable it.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#68

Post by vbernat »

nrabulinski wrote: post #38
wwweston wrote: post #17

Earlier quoted context omitted.

Discord leaks which apps you're using to other people?

It “leaks” which apps you’re using if the developer explicitly talks to the discord client. Discord provides an SDK for game developers etc which can talk to discord client and show the game you’re playing and optionally let you invite people to your lobby straight from the discord chat. It doesn’t scan anything or open any processes, it just opens an IPC socket.

It also scans processes. Easy to check: run opensnoop.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#69

Post by 3r8Oltr0ziouVDM »

When you run proprietary software, you basically give full control over your computer to a third party. For the best security use a separate physical machine for stuff like this. Or a separate operating system (in such case your primary system should be encrypted and have a protected boot loader). Or at least a VM.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#70

Post by woodruffw »

cranekam wrote: post #65
reilly3000 wrote: post #50

Zoom has a popular feature which allows for screen sharing a single application window instead of the entire desktop. I assume this is how its discovering running applications with GUI windows open in a cross-platform manner. Perhaps there is a better API for this? Its not a common use-case that an app would need to know all of the other open windows, but it seems like a perfectly valid use case, and frankly handy fo…

There’s nothing in /proc/PID/cmdline etc that would definitely confirm an app has a GUI. The two concepts are at very different layers of the stack — to the OS the GUI is just another app on top of the kernel. Mayyyyyybe Zoom could be doing some crude pattern matching on process name or environment variables of a given process (though it’d only be able to read data of processes running as the same user) but it’s a lo…

This is an unlikely stretch, but it looks like they're also attempting to read `/proc/PID/exe` -- they could be doing something (extremely) cursed like attempting to parse the program linkages and filtering by programs that link to `libX11`. But that's me straining to explain this in the context of the GP's hypothesis.
Post reply on HN