Live data from Hacker News

Zoom’s Use of Facebook’s SDK in iOS Client

blog.zoom.us

131–140 of 272 posts

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#131
post #27

It's good that they removed it, but it's also dissapointing that they had no idea that it was happening until someone made a blog post about it. Do their employees not vet any of the code they use, and just slap things together off the internet and hope it's not doing anything their users don't like?

It's an imported library. Almost nobody vets those libraries ever. And that's the current state of software supply chain.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#132
post #77

Earlier quoted context omitted.

> Do their employees not vet any of the code they use, and just slap things together off the internet That sounds like a pretty accurate description of how software is built. (No, I'm not being flippant.) > ... and hope it's not doing anything their users don't like? I expect most don't think too much about it, not out of malice, but because their product manager told them "I want FB login" and to do that, they eithe…

I've worked at places where "cowboy coding" was the norm and people would just look up how to do something on StackOverflow and copy/paste it. But to pull in a major 3rd party dependency like this and just "YOLO" ship it in your company's product? That's almost unbelievable. Didn't anyone have a look to see what the thing does? Assuming the SDK comes with source code, and if they integrated a 3rd party library that d…

Lots of tempting 3rd party iOS frameworks are binary only without source, such as Google Maps for iOS. Who knows what kind of telemetry and event listeners these frameworks install.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#133

Earlier quoted context omitted.

honest question: _how_ do we attack the underlying systematic problem to solve it once and for all? write a blog post? take it twitter/HN/reddit? hold a rally/demonstration outside Apple/Google? call our MP? bombard their employees with phone calls or knock on their front door where they live? write malware? ... really I got nothing that sounds like it would work. In retrospect all of Tim Cook's privacy / security gr…

Legislation?

sure, but since I am unable to actually make legislation I wrote "call your MP" - which is more sobering/realistic if you look at the likely success of this particular effort.

We're outgunned by the lobbying from these companies I think.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#134
post #106

Earlier quoted context omitted.

I think it doesn't always have to scale. Zoom is a huge player right now and in great usage across all industries, countries and users.

Really?!? If it wasn't for this post I wouldn't even know that they exist.

In that case, I should probably tell you that it’s a good idea to wash your hands.

Check any news outlet to know why, and you’re likely to also read about zoom in some article.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#135
post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

I'm really liking Zoom's responses to incidents lately. Both this and the "oops we implemented certain features by leaving a localhost webserver gaping open" fiasco fairly recently got extremely nimble responses from them, and the responses were absolutely the right thing to do. They could have hand-waved the http server away and claimed to have "secured" it, and they could have hand-waved this away as "standard practice", which, let's be frank, it almost certainly is. The fact that they understood the seriousness and swiftly yanked the features in both instances is HUGE. Kudos to them for this.

edit: some people won't want to give them any slack because they committed the offenses in the first place, but I think that's silly. Reward them for trying, because if this is the way they're going to respond to blowing it, they're one of the good guys.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#136
Nice way to bury an innocuous "iOS Advertiser ID" in the middle of the list. What "iOS Advertiser ID" means is, to a very good degree of approximation, your deanonimized identity.

Also, that just linking the SDK in your app deanonimzes the user to Facebook is very, very clear in its documentation. It's not like Zoom didn't notice until someone told them. They made a decision, and now they're changing it because they were called out.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#137

Earlier quoted context omitted.

You can pretty easily see all the traffic on your own phone. You can even do it on device https://apps.apple.com/us/app/charles-proxy/id1134218562

Seeing it != blocking it.

You basically need your own VPN server with Pi-hole installed to control the tracking. It is a very effective way to block this, but not that easy to setup.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#138
post #111
post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

Get mad at Facebook for stuffing analytics into their login button library

Note that the functionality is actually attribution for the app adds platform on Facebook. If you run ads on FB for an app, this ensures installs are tracked, and doesn't show the user the ad if they already have it.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#139
post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

But there could be a law, Apps have to have an option to write all telemetric data to a text file.

Re: Zoom’s Use of Facebook’s SDK in iOS Client

#140
post #62
post #45

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting ma…

I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent. Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private. Blaming Apple? Why, when Zoom is on the Play Store as well? https://play.google.com/store/apps/details?id=us.zoom.videom... >As long…

Just to take you up on possible FOSS solutions: If anyone is looking for a private and open source video chat platform self-hosting NextCloud [0] might be worth a try.

[0]: https://nextcloud.com/talk/

Post reply on HN