Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why does Zoom Desktop examine all processes and arguments?

news.ycombinator.com

Post reply on HN
Print view View original

181–190 of 277 posts

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#181

Post by Wowfunhappy »

NoPicklez wrote: post #179
Wowfunhappy wrote: post #112

Earlier quoted context omitted.

They drove me so insane that I abandoned modern macOS entirely.

What's the solution then? MacOS is exposing how often these programs are requiring privileged access. The solution is partly for applications to limit their use of elevated privileges which we can't always rely on. Therefore MacOS is exposing and providing users with visibility and choice.

Let me turn these prompts off globally. Maybe log the requests somewhere for me to review later if I so choose. I'm just going to hit "Allow" anyway.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#182

Post by gwbas1c »

I'm going to assume this happens when you aren't trying to share your screen.

I once worked on a file synchronization application that would scan processes when files were locked. I don't remember if we put the process name in the UI, but we logged detailed information about the other process in case someone contacted support. (Sometimes users ran weird applications that kept files locked.) I believe we had to scan through all processes and inspect their open file handles.

I would assume some things like: Maybe there are applications that are known to cause problems for Zoom? Maybe some applications lock the camera or microphone? Maybe some applications hog the CPU and cause encoder problems?

If you really want to know more, consider decompiling zoom and/or looking at strings compiled into the binary.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#183

Post by dllthomas »

gwbas1c wrote: post #182

I'm going to assume this happens when you aren't trying to share your screen . I once worked on a file synchronization application that would scan processes when files were locked. I don't remember if we put the process name in the UI, but we logged detailed information about the other process in case someone contacted support. (Sometimes users ran weird applications that kept files locked.) I believe we had to scan…

It happens right at startup, and is a result of some calls (via the usual fork/exec dance) to `pidof ...` seemingly trying to identify the window manager being used, possibly for telemetry or possibly to change behavior. Decompiling would be more certain (I don't have ghidra on this computer and it's a little more effort than I want to go to) but the pattern is pretty visible in the strace dump.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#184

Post by dllthomas »

dathinab wrote: post #175
thxg wrote: post #152

Earlier quoted context omitted.

^ This is the correct answer. I installed the Zoom client just to have a look for myself. The syscalls in question emanate from freshly forked processes that immediately execvp() the command `pidof` (on my system it finds it under /usr/bin, so it's the system command, not anything fishy shipped by Zoom). Actually, the command-line argument to the command is, in succession: gnome-session gnome-panel gnome-shell gnome-…

> This hints at a very crude way to determine the desktop environment! That is a good discovery. It's probably one of the better ways to detect the running desktop environment as the user might have multiple environments installed and just uses one of them currently, as such looking for installed things doesn't work reliable. And looking for env variables can be unreliable. And scanning the dbug might not be that use…

I mean, in principle the user might be running multiple X servers with different WMs, but that's probably rare enough. I'm also a bit curious what it's actually used for (but not quite curious enough to dig out ghidra, given the other constraints on my time at the moment...)

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#185

Post by gwbas1c »

dllthomas wrote: post #183
gwbas1c wrote: post #182

I'm going to assume this happens when you aren't trying to share your screen . I once worked on a file synchronization application that would scan processes when files were locked. I don't remember if we put the process name in the UI, but we logged detailed information about the other process in case someone contacted support. (Sometimes users ran weird applications that kept files locked.) I believe we had to scan…

It happens right at startup, and is a result of some calls (via the usual fork/exec dance) to `pidof ...` seemingly trying to identify the window manager being used, possibly for telemetry or possibly to change behavior. Decompiling would be more certain (I don't have ghidra on this computer and it's a little more effort than I want to go to) but the pattern is pretty visible in the strace dump.

Maybe it has to alter behavior based on your distro?

IMO, if you can't/won't reverse engineer, maybe see if you can contact Zoom support and see what they say? Obviously the support people won't know, but if you can ask the right way they might pass your question on to the developers.

For the file sync client, we got all kinds of oddball questions passed along from support to developers; and we'd make an honest effort to answer reasonable ones.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#186

Post by dllthomas »

gwbas1c wrote: post #185
dllthomas wrote: post #183

Earlier quoted context omitted.

It happens right at startup, and is a result of some calls (via the usual fork/exec dance) to `pidof ...` seemingly trying to identify the window manager being used, possibly for telemetry or possibly to change behavior. Decompiling would be more certain (I don't have ghidra on this computer and it's a little more effort than I want to go to) but the pattern is pretty visible in the strace dump.

Maybe it has to alter behavior based on your distro? IMO, if you can't/won't reverse engineer, maybe see if you can contact Zoom support and see what they say? Obviously the support people won't know, but if you can ask the right way they might pass your question on to the developers. For the file sync client, we got all kinds of oddball questions passed along from support to developers; and we'd make an honest effor…

Not a bad thought, though ghidra would be more fun.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#187

Post by kiwijamo »

yakubin wrote: post #118
aetherspawn wrote: post #105

Earlier quoted context omitted.

They are grayed out for everyone else, so they can’t actually read the contents. Caveat being if you move the window around really fast sometimes it’s possible to catch a glimpse.

Maybe that's changed, but a couple months ago we tested it on vanilla Ubuntu in the team at $dayjob and we could see everything. Nothing was grayed out.

Zoom on Mac and/or windows seems to black out other windows if they appear on top of the target window. I've seen that happen a few times so definitely does happen, just perhaps not on Linux.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#188

Post by _sgianelli »

thephyber wrote: post #24
_sgianelli wrote: post #11

Earlier quoted context omitted.

If so that seems like a great place for someone like Apple or Microsoft to offer an API to bolster security and privacy

OS X already requires that the user open Settings and give the app elevated permissions to be able to share the screen. One can argue about the granularity, but you can’t argue that Apple hasn’t already done something.

Oh I don't mean to say they haven't done anything, they certainly have. I'm more wondering if there is a system-level privacy feature that they could provide (enforce?) where the system provides a screen share stream handle to only a selected window, similar to the Selected Photos functionality in iOS today.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#189

Post by aetherspawn »

yakubin wrote: post #118
aetherspawn wrote: post #105

Earlier quoted context omitted.

They are grayed out for everyone else, so they can’t actually read the contents. Caveat being if you move the window around really fast sometimes it’s possible to catch a glimpse.

Maybe that's changed, but a couple months ago we tested it on vanilla Ubuntu in the team at $dayjob and we could see everything. Nothing was grayed out.

Sounds like it works a little differently on Linux.

To be honest, I'm actually surprised and impressed that they support screen share in the Linux version because of how many different flavors of i.e. WM there are in the wild.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#190

Post by IgorPartola »

woodruffw wrote: post #180
gmueckl wrote: post #147

Earlier quoted context omitted.

Do you have evidence of old being executed or similar? The posted strace log section is fairly benign and shows no hints of what you insinuate.

You wouldn’t actually need to execute `ldd` to get this information: you could parse the ELF entirely in user space. That, in turn, wouldn’t show up in the `strace` logs, since there would be no syscalls. I think that’s extremely unlikely, but it’s certainly possible.

Reading the file would show up as syscalls.
Post reply on HN