Live data from Hacker News

Linux Zoom client proactively reading everything written to X11 clipboard

hachyderm.io

31–40 of 176 posts

Re: Linux Zoom client proactively reading everything written to X11 clipboard

#31

Earlier quoted context omitted.

Great, til I have a job interview and they use Zoom

Srsly, all those neck beards who over simplify the problem with a flippant "don't use zoom", as if everyone has the luxury to skip every job interview and employer meeting that absolutely requires Zoom. I wish I could live in their world where every problem is solved by simply avoiding that problem.

Zoom isn't just a technical problem. It's literally malware. The list of issues they've knowingly caused and sometimes even refused to fix is endless. They have made it clear they absolutely don't care about security in any way and they've built their entire business around that.

As I work in cyber security there's no way I'll install that shit on my personal PC. Yes I could spin up a VM but I don't want to. I could probably use it over the web but that's it.

So I'd refuse and that company's reply should inform me whether I'd want to work there in the first place. If they insist their security practices will be so lax that I will be just spending my time cleaning up everyone else's mess. In fact any employer using zoom in the first place is a huge red flag.

I currently work for a huge multinational and they have the zoom client blocked through antimalware. Anyone wishing to use it with customers or suppliers must use the web version only.

Re: Linux Zoom client proactively reading everything written to X11 clipboard

#32

Earlier quoted context omitted.

Great, til I have a job interview and they use Zoom

Srsly, all those neck beards who over simplify the problem with a flippant "don't use zoom", as if everyone has the luxury to skip every job interview and employer meeting that absolutely requires Zoom. I wish I could live in their world where every problem is solved by simply avoiding that problem.

This is a habit tech people fall into. "Amazon deleted my book" -> well just strip the DRM off it. "My ISP monitors me" -> well just use a VPN instead. "Ads make it hard to use the internet" -> well just use an ad blocker.

Ironically if more tech people just rawdogged the internet I think we would have more progress.

Re: Linux Zoom client proactively reading everything written to X11 clipboard

#33

Earlier quoted context omitted.

Srsly, all those neck beards who over simplify the problem with a flippant "don't use zoom", as if everyone has the luxury to skip every job interview and employer meeting that absolutely requires Zoom. I wish I could live in their world where every problem is solved by simply avoiding that problem.

This is a habit tech people fall into. "Amazon deleted my book" -> well just strip the DRM off it. "My ISP monitors me" -> well just use a VPN instead. "Ads make it hard to use the internet" -> well just use an ad blocker. Ironically if more tech people just rawdogged the internet I think we would have more progress.

Unfortunately, experience teaches people one can't affect political policy with gadgets, or deny human nature. =3

https://harmful.cat-v.org/people/basic-laws-of-human-stupidi...

Re: Linux Zoom client proactively reading everything written to X11 clipboard

#34

Earlier quoted context omitted.

Great, til I have a job interview and they use Zoom

Srsly, all those neck beards who over simplify the problem with a flippant "don't use zoom", as if everyone has the luxury to skip every job interview and employer meeting that absolutely requires Zoom. I wish I could live in their world where every problem is solved by simply avoiding that problem.

My partial solution is to have the Android Zoom client on an idle tablet. Even though it is my office VOIP phone too, I power it off when I don't have meetings scheduled.

If someone tries to demand screen sharing, I ask one of my coworkers to drive, since they've joined from their laptop already.

I only launch the Linux Zoom client when I absolutely know I'm going to need to host a meeting and demonstrate software running on my end. I feel equally disgusted about Zoom and the corporate EDR agent. I basically feel like the most likely source of compromise of my laptop is these proprietary tools forced on me from above.

The thing that worries me is SSO for work. I wish there was a completely different identity for all the work-related apps and for my payroll/benefits portal. I.e. if they want to endanger my login that manages my work product, fine, but I don't appreciate them endangering my login that manages my own compensation, tax deductions and retirement transfers, and health insurance...

Re: Linux Zoom client proactively reading everything written to X11 clipboard

#36
post #30

Earlier quoted context omitted.

What's it like using Qubes? How much friction? I wish I could use some Nix-flavored variant of the sandboxing.

I dumped it after realizing Xen does its damndest in preventing you from hiding VM attributes from Guest OSes. Proxmox uses KVM, and is easy to configure a VM to make the guest think it's on bare metal. In the proprietary software space, a LOT of things run badly or refuse to run, or license stupidity with a guest OS. So for me, spoofing bare metal is an essential part of running ilk like Windows and proprietary apps…

Doesn't that preclude paravirtualization drivers? Seems like a major tradeoff for daily driver desktop stuff.

Re: Linux Zoom client proactively reading everything written to X11 clipboard

#37
post #21

I'm not surprised by news like this anymore. When will Linux distributions properly sandbox our applications? Our phones have had a better permission system for years.

Android allows apps to read from the clipboard at will, though it does show a toast. GrapheneOS, I believe, asks for permission first.

Re: Linux Zoom client proactively reading everything written to X11 clipboard

#39

Earlier quoted context omitted.

Great, til I have a job interview and they use Zoom

Spin up your own instance and ask them to join!

Great idea, if you want to stay unemployed.

How many corpo HR/recruiter types you met that will gladly bypass company policy and switch to the tools demanded by the candidate?

Re: Linux Zoom client proactively reading everything written to X11 clipboard

#40

Qubes OS saved me, once again. On it, Zoom only has the access to an empty VM and no access to the clipboard.

What's it like using Qubes? How much friction? I wish I could use some Nix-flavored variant of the sandboxing.

Depends on how you use your computer. If you're mostly a developer/analysis terminal jockey with some browsing-- Qubes is a tremendous upgrade even if you don't care at all about the security properties:

The normal qube model of template OS vms + ephemeral app overlays makes it a cinch to troubleshoot complex issues because you can scribble all over the VM (e.g. go ahead, monkey patch your system LIBC if you want!) and all those changes will be gone when you restart the VM. Once you do find a solution you like, you can apply it cleanly and intentionally to the template. If all you were doing was a one-off, then no need to go make it permanent. Not sure if the latest Fedora upgrade is going to break stuff you care about? Install and switch to it one appvm at a time. Something breaks, file a bug and switch that one back until its fixed.

I've had friends screwing around with AI agents get their systems really screwed up because running the agent in a VM was work and requires maintenance. .. in qubes its just the natural way to run it, a few clicks and you're good to go. And the maintenance overhead of running in a VM is mostly non-existent.

If you ever use VPNs for privacy or to access protected networks-- Qubes is a big upgrade: You can run multiple VPN network VMs and then pick on an AppQube by AppQube basis which network they use. Then you don't have to worry about malware from your reddit browsing VM (or your Erotic MLP fanfic) going out over your employer's network or your banking going out via some Norwegian anonmization proxy that might spy on your traffic or cause your bank to instantly block your account. You can accomplish this without qubes but in qubes its particularly easy (and easy to get right): Every VM that has network access has it provided by another VM. Configure the networking how you like in that service VM and then pick what uses it.

When I say 'developer' above I don't mean to suggest that Qubes is particularly hard to use-- as I know significantly less technical people who use it without issue. But its non-security/privacy advantages are most significant if you're doing experimentation with the computer's configuration.

However if you're doing stuff that is Video heavy-- particularly gaming, and to a lesser extent CAD, video editing, etc. Qubes really brutally hurts video performance. It can be somewhat offset by running on higher end hardware (and then getting performance of a few year older system). Even just watching youtube videos is obvious impacted.

Similarly, it dents battery life. This is addressable via additional batteries given that now laptops are usbc powered and 100wh external batteries are readily available. But this is something of a lifestyle question.

Even before the AI-apocalypse I considered qubes to be non-negotiable on laptops-- there are just far far far too many browser RCE vulnerabilities to consider anything less for any computer that isn't a total security write-off.

Previously if I followed a link to a sus site and had my browser crash (maybe even the day before a RCE-in-the-wild was announced). I'd have some rationally justified paranoia that my whole computer might be compromised. Now, I can close the app VM (or-- better-- toss the disposable, which I try to use for most browsing) and know that even if they exploited the browser they'd have to have a VM escape of some kind too to do me any lasting damage.

The highest security stuff still ought to be on isolated hardware, of course. But using a multipurpose computer without qubes is unsafe at any speed, worse than driving without a seatbelt.

Post reply on HN