Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why does Zoom Desktop examine all processes and arguments?

news.ycombinator.com

Post reply on HN
Print view View original

251–260 of 277 posts

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#251

Post by dsr_ »

Wowfunhappy wrote: post #159
dsr_ wrote: post #37

Earlier quoted context omitted.

If you must use zoom, use it in a browser; uninstall their app.

But it doesn't work particularly well that way! It's workable, but calls seem to have worse quality and more latency. By all means, use it if you feel it's necessary, but you're giving up a lot!

Yes! It's a literal tradeoff between security and functionality, the same tradeoff that people make every day.

Figure out which one you want; Zoom is unwilling to give you both, even when you're paying them.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#252

Post by est »

neurostimulant wrote: post #203
est wrote: post #200

Earlier quoted context omitted.

Any application allows remote screen recording is basically a trojan horse.

By that definition all major browsers are trojan too because they can capture screens and windows via screen capture api.

Therefore I always manually modify browser binary and rename screen capture api to something else.

I also disable WebRTC.

It's a shame Google's Blink don't offer an option to turn off features.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#253

Post by eadmund »

aetherspawn wrote: post #189
yakubin wrote: post #118

Earlier quoted context omitted.

Maybe that's changed, but a couple months ago we tested it on vanilla Ubuntu in the team at $dayjob and we could see everything. Nothing was grayed out.

Sounds like it works a little differently on Linux. To be honest, I'm actually surprised and impressed that they support screen share in the Linux version because of how many different flavors of i.e. WM there are in the wild.

I don't believe that the WM would enter into it — as long as folks are using X11 the code should be, I think, the same for any WM or DE.

Now, using Wayland it may or may not be possible, depending on which WM/compositor/whatever you are running.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#254

Post by bamboozled »

acatton wrote: post #249
bamboozled wrote: post #240

Earlier quoted context omitted.

If you dnf/apt install everything from the official repos of your distro, you wont have any misbehaving apps. And that model still holds. How do you know this? I hear this a lot, I've built packages myself, only because I needed them in a hurry. I never really went through the source code to make sure it's safe. Maybe others did, but I didn't, people installed the package, maybe they were hacked, who knows? Just sayi…

When a package lands in Debian Sid or in Fedora Rawhide, there is a group/subculture of nerds who like to inspect it and report any misbehaviour. [1] [2] I usually do this directly on the source project, but some people in this subculture do it in their distro. Also I'm surprised your packages landed in Debian/Fedora, because there is a review process… I'm not talking about a ppa repo or a copr repo, anybody can run…

If you think of the millions of lines of code these people are just looking at, you'd have to be pretty damn good to pickup everything?

Thanks for sharing

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#256

Post by rocho »

swiley wrote: post #228
dmart wrote: post #129

Perhaps a better question to ask would be "why is any process allowed to do this by default in 2021?"

Because you're not supposed to be downloading random binaries from the internet and running them like some toddler on Windows or OSX would. STOP DOING THAT.

How do you know that a program does this, without running the binary? I'd say that requires expert knowledge not available to most people.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#257

Post by woodruffw »

IgorPartola wrote: post #190
woodruffw wrote: post #180

Earlier quoted context omitted.

You wouldn’t actually need to execute `ldd` to get this information: you could parse the ELF entirely in user space. That, in turn, wouldn’t show up in the `strace` logs, since there would be no syscalls. I think that’s extremely unlikely, but it’s certainly possible.

Reading the file would show up as syscalls.

Sure, but you could minimize it to just two: the `open` that we already see here, and an `mmap` that maps the entire thing in. The rest could be in userspace (at least in terms of effects). We only have an excerpt of the syscall trace, so it's possible that happens.

But again: extraordinarily unlikely.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#258

Post by [deleted] »

stinos wrote: post #231
dathinab wrote: post #162

Earlier quoted context omitted.

Why would you implement such a overly complex and unreliable thing when: 1. The windows manager can provide you with a list of open windows. 2. Screensharing including only sharing specific windows is a feature provided by the windows manager over standardized protocols. 3. Even knowing the processes which do have a GUI doesn't allow you to share that GUI, at least not without going through roughly the same mechanism…

The windows manager can provide you with a list of open windows. But that needs a unified way for this across window managers, does that exist?

[deleted]

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#259

Post by woodruffw »

inter_netuser wrote: post #202
woodruffw wrote: post #178

Earlier quoted context omitted.

Hence “unlikely stretch.”

Let's just say the quiet part outloud: they sell that data.

They probably don't. The list of programs running on a random Linux box probably isn't especially valuable.

Re: Ask HN: Why does Zoom Desktop examine all processes and arguments?

#260

Post by nullc »

cranekam wrote: post #205
nullc wrote: post #193

How else would they backup your command-line passed passwords and private keys for you?

I assume this is a joke comment because I have never heard of passing a private key (the contents of one, not the file name) as a command line argument. It’d be ten times worse than asking what someone’s wifi password was and being told some 40-digit hex string.

People pass private keys on command-lines, particularly with ecc crypto (because the keys are short). It's a really bad idea, but that doesn't mean it isn't sometimes done.
Post reply on HN