61–70 of 176 posts
Earlier quoted context omitted.
Spinning up a conference host for a small office is fairly trivial =3 https://jitsi.org/downloads/
If we are doing a survey of self hosted video conferencing services I would like to propose galene. Very easy to set up, I run it on obsd(an unsupported platform) and it just works. https://galene.org/
The "clipboard" as it is implemented in many (most?) operating systems today, only exists because it's a legacy idea that hasn't died. If it were freshly invented today, it would never get past even the most lenient privacy review. Think about the pitch for the feature: "So, we're going to make this in the OS, where the user can highlight anything in any application, invoke a command, and then that thing (which could…
No. You're assuming that you don't have control of your own computer. Think about the pitch for removing the feature, "So, we're going to make this in the OS, where visually disabled users cannot highlight anything in any application, can't move text between applications, cannot get the window title, cannot get the window tree, cannot have applications automate or know where other applications are, and basically they…
There is no such thing as an "X11 clipboard" that something can be written to. As the poster goes on to allude, X11 has a concept of a "selection" (a primary and a secondary one). It goes roughly like this: when you select a text in a window, the X client tells the X server "I have the selection now", when you paste in another window, the client behind the other window asks "who has the selection?" and requests the s…
Not the first time Zoom abuses privilege. A few years back, there was something about gaining root on MacOS via Zoom due to shady execution on their end. They've lost my trust since then, and I'll only run it sandboxed: https://gist.github.com/cielavenir/02f322e322a2a3555dbf2b38f... I always ask (1) why does an app require installation and (2) why would it require root? There are valid answers for both, but realistic…
Out of interest why do you still use the app and not just use it in the browser? I feel much more secure having it in the browser sandbox and everything I care about works in the browser.
Do not know if this is still true, but at one point, the web player would only let you see one speaker at a time, while the app would show multiple people at once.
Not the first time Zoom abuses privilege. A few years back, there was something about gaining root on MacOS via Zoom due to shady execution on their end. They've lost my trust since then, and I'll only run it sandboxed: https://gist.github.com/cielavenir/02f322e322a2a3555dbf2b38f... I always ask (1) why does an app require installation and (2) why would it require root? There are valid answers for both, but realistic…
> There's no legitimate use for it accessing privileged or private paths.
Well, that was the whole premise that made Zoom popular in the first place! It was a true one click install which made onboarding frictionless for non-technical users
Security wise, it's insane but user experience wise, it was unbeatable and is what solidified their position. It's ironic nowadays that all of those tricks have been stripped away, making it just as painful as any other platform to install on a fresh machine.
Not the first time Zoom abuses privilege. A few years back, there was something about gaining root on MacOS via Zoom due to shady execution on their end. They've lost my trust since then, and I'll only run it sandboxed: https://gist.github.com/cielavenir/02f322e322a2a3555dbf2b38f... I always ask (1) why does an app require installation and (2) why would it require root? There are valid answers for both, but realistic…
Yes Apple even blocked their app because they refused to fix it. Eventually they did and unfortunately they were allowed again. It wasn't really root as much as an open backdoor on a TCP port as far as I recall.
Zoom used the same technique Cisco Webex did - they ran a webserver with an open port so that local "links" to a meeting could open on your own machine. It wasn't a backdoor. Apple flagged that as a potential security risk, so Zoom worked with Apple on how to safely remove only the webserver without affecting other functionality. We were happy that Apple worked with us on this.
However, I thought it was very interesting (and strange) that there was almost no reaction from the tech community that Apple had software running on every Mac that allowed them to remove any binary they wished. (Which sure sounds like a backdoor)
Unrelated to Zoom, but > I noticed it because I make heavy use of a "one-shot paste" tool which fulfills a single paste request and then terminates. Handy for filling in lots of fields of a web form – queue up pastes of several different things, then go to each form field in turn and just hit paste, bam bam bam. This sounds very useful. Is the tool available anywhere? xclip -loops doesn't seem to do the trick, or may…
Turns out, Wayland has wl-copy: https://man.archlinux.org/man/wl-copy.1 (i was also interested :)
Earlier quoted context omitted.
Yes Apple even blocked their app because they refused to fix it. Eventually they did and unfortunately they were allowed again. It wasn't really root as much as an open backdoor on a TCP port as far as I recall.
I worked at Zoom during this time. That's not what happened. Zoom used the same technique Cisco Webex did - they ran a webserver with an open port so that local "links" to a meeting could open on your own machine. It wasn't a backdoor. Apple flagged that as a potential security risk, so Zoom worked with Apple on how to safely remove only the webserver without affecting other functionality. We were happy that Apple wo…
'But Cisco did it too!' is just whataboutism. It was shown to be exploited (IIRC to open scam websites) which was a real backdoor and a legitimate security risk, not a potential one.
This is something that should never have happened in the first place. Even releasing something like this in the first place is really showing no concern for the security of customers at all. What it looks like to me is that zoom wanted to conquer the market by ease of use and was willing to sacrifice security to do it. The zoombombing thing was another example.
And yes Apple has an emergency brake for malware outbreaks. And they've only used that one for high profile apps once, for zoom. They didn't do that lightly, especially during the pandemic when people were depending on it.
Really I have no good words for the actions of zoom. And there have been more incidents.
I was involved in mitigating these screwups in my work, what we did was flag zoom as malware ourselves so it automatically got removed from every company machine. And block it from being installed by the user. This block is still in place.
Ps I'm sorry if I sound harsh but zoom has caused several security worries at work and we don't even use it.
Earlier quoted context omitted.
I worked at Zoom during this time. That's not what happened. Zoom used the same technique Cisco Webex did - they ran a webserver with an open port so that local "links" to a meeting could open on your own machine. It wasn't a backdoor. Apple flagged that as a potential security risk, so Zoom worked with Apple on how to safely remove only the webserver without affecting other functionality. We were happy that Apple wo…
Apple did block the app so the 'working with Apple' didn't exactly earn Zoom a lot of trust with them otherwise they wouldn't have done it. They'd have let Zoom fix it in an update. And just make that update mandatory. They were just looking out for their own customers in limiting the impact, but for them to pull this handbrake means they really saw this as a big risk. 'But Cisco did it too!' is just whataboutism. It…
A whataboutism that makes a legitimate point. It isn't reasonable to dismiss something just because a person makes a comparison. It's valid to consider that Apple might have been applying inconsistent standards and unfairly targeting Zoom for some reason.
I doubt they were being unfair but it is a bad practice to dismiss an argument because someone has the temerity to expect consistent standards. The threat of Apple arbitrarily removing apps based on unreliable reasoning is concerning.