[flagged]
Linux Zoom client proactively reading everything written to X11 clipboard
121–130 of 172 posts
Re: Linux Zoom client proactively reading everything written to X11 clipboard
#122I wish most Linux distributions had something like a standardized permission manager in which you enable the single policies apps are running with, similarly to what happens in Android (that has some Linux stuff under the hood). How hard would it be to have something like this? And I can’t even imagine the difficulty of gathering together the whole community around this standard...
Quite hard because on Linux there is no concept of "apps". There is a (very flimsy) separation between processes, but the strongest actual security boundaries are between kernel and user space as well as between users. Namespaces are explicitly not acknowledged as such, which limits the security guarantees that containers can provide.
Snaps and Flatpak are steps towards that goal, but there are many issues surrounding these technologies, and many apps require sweeping permissions to work well since they were not initially designed to be limited in that way.
Re: Linux Zoom client proactively reading everything written to X11 clipboard
#123I wish most Linux distributions had something like a standardized permission manager in which you enable the single policies apps are running with, similarly to what happens in Android (that has some Linux stuff under the hood). How hard would it be to have something like this? And I can’t even imagine the difficulty of gathering together the whole community around this standard...
> similarly to what happens in Android
Do you wish to give this app access to _all_ your {files, photos, phone calls, messages} ? /s
What do we need permissions for, then ? Let MS-DOS come back.
Re: Linux Zoom client proactively reading everything written to X11 clipboard
#124I wish most Linux distributions had something like a standardized permission manager in which you enable the single policies apps are running with, similarly to what happens in Android (that has some Linux stuff under the hood). How hard would it be to have something like this? And I can’t even imagine the difficulty of gathering together the whole community around this standard...
It'd be easy, just build it into systemd.
.../s
Re: Linux Zoom client proactively reading everything written to X11 clipboard
#125Earlier quoted context omitted.
Not parent, but the web player used to be a down-graded experience from the native app. If you need Zoom for a professional setting, those functions could be important. Do not know if this is still true, but at one point, the web player would only let you see one speaker at a time, while the app would show multiple people at once.
So the web is a better experience!
Unless you have to run the meeting.
Re: Linux Zoom client proactively reading everything written to X11 clipboard
#126Earlier quoted context omitted.
Apple did block the app so the 'working with Apple' didn't exactly earn Zoom a lot of trust with them otherwise they wouldn't have done it. They'd have let Zoom fix it in an update. And just make that update mandatory. They were just looking out for their own customers in limiting the impact, but for them to pull this handbrake means they really saw this as a big risk. 'But Cisco did it too!' is just whataboutism. It…
> Ps I'm sorry if I sound harsh Actually, thanks, that did go a long way. It's not whataboutism, I'm not trying to distract from the point, I'm saying there was _prior art_ in the industry where customers appeared to tolerate this. There was another PM on the team who felt the same way I did and we basically both wagged our fingers and said "you should have asked people during install", but who cares, it was too late…
> I thought Apple's tool was ridiculous though. It's like "oh, some trash blew into our yards from the neighbor's trashcan" so Apple replies "oh, don't worry, I destroyed it with my orbital ion cannon" and the tech community never stops to wonder if maybe it's a little strange that Apple has an orbital ion cannon and maybe we should ask some questions about the ion cannon.
Nah, that's very on brand with Apple. The Apple ecosystem is well-known to be a walled garden where they rule and are very stringent about separation to the outside and being in control. People who use Apple products know what they are getting into.
Re: Linux Zoom client proactively reading everything written to X11 clipboard
#127Earlier quoted context omitted.
but sandboxing would be quite useless
How so? If you can break out of a sandbox then by definition it is not a sandbox. There are ways to force sandbox jail. For instance, giving processes only a partial view of the computer system. GoboLinux did this years ago via ViewFS ( https://linuxphilia.blogspot.com/2009/07/gobolinux-is-linux-... search for ViewFS). There are many other similar solutions, some probably better.
You need to sandbox X11 which requires giving up X11 capabilities just like Wayland did.
Re: Linux Zoom client proactively reading everything written to X11 clipboard
#128Not the first time Zoom abuses privilege. A few years back, there was something about gaining root on MacOS via Zoom due to shady execution on their end. They've lost my trust since then, and I'll only run it sandboxed: https://gist.github.com/cielavenir/02f322e322a2a3555dbf2b38f... I always ask (1) why does an app require installation and (2) why would it require root? There are valid answers for both, but realistic…
> A few years back, there was something about gaining root on MacOS via Zoom due to shady execution on their end. > There's no legitimate use for it accessing privileged or private paths. Well, that was the whole premise that made Zoom popular in the first place! It was a true one click install which made onboarding frictionless for non-technical users Security wise, it's insane but user experience wise, it was unbea…
Unfortunately making software easy to install also makes it easier for Malware to be installed. It's a classic dilemma that is only fixable by making the user think twice about running stuff from the internet: Unix requires making the file executable, Windows at some point started tagging downloaded files with an "untrusted" attribute.
Re: Linux Zoom client proactively reading everything written to X11 clipboard
#129That's so sad. These companies try to ruin Linux by spying on the user here.
It's not about Linux.