I always ask (1) why does an app require installation and (2) why would it require root?
There are valid answers for both, but realistically, all a videoconferencing app should need (apart from audio and video and maybe screen sharing) is to store a config file.
There's no legitimate use for it accessing privileged or private paths.
On Linux/X11 even when you run a program sandboxed or as a different user if you use a master Xserver the sandboxed program still can listen and modify all your input/output including keyboard/mouse events and window content of every application.
I think the only possibility that comes to mind is creating an ebpf module that sandboxes all filesystem calls and trampolines all ld_open calls.
But then you would have to provide massive amounts of patched/"safe" variants of all kinds of shared libraries which is unfeasible.
But I mean in the xorg use case it would be possible to just provide your own library that fakes the expected returns and sends fake data to the sandboxed applications.
I did a similar thing with barrier (though using LD_PRELOAD, see [1]) on my debian system to force a different behavior.
Source: Am kind of experimenting with ebpf a lot for that use case. C ABIs and SO files are a mess though. A real messy mess.
Not really - it's not sufficiently fine-grained and, besides, you need it to connect to X to display anything.
There were various attempts to improve this situation in the early 2010s, typically using Xnest or Xephyr in conjunction with other sandboxing techniques. I believe Qubes OS followed that approach but it was awkward, limited, had major performance problems, and yet never managed to fully prevent circumvention.
The fact is that the X model was never designed with these threats in mind.
> I believe Qubes OS followed that approach but it was awkward, limited, had major performance problems, and yet never managed to fully prevent circumvention.
Not sure what you are talking about. Qubes offers reliable protection with decent performance, unless you work with graphics. See also: https://news.ycombinator.com/item?id=49678250
How so? If you can break out of a sandbox then by definition it is not a sandbox.
There are ways to force sandbox jail. For instance, giving processes only a partial view of the computer system. GoboLinux did this years ago via ViewFS (https://linuxphilia.blogspot.com/2009/07/gobolinux-is-linux-... search for ViewFS). There are many other similar solutions, some probably better.
Out of interest why do you still use the app and not just use it in the browser? I feel much more secure having it in the browser sandbox and everything I care about works in the browser.
Not parent, but the web player used to be a down-graded experience from the native app. If you need Zoom for a professional setting, those functions could be important.
Do not know if this is still true, but at one point, the web player would only let you see one speaker at a time, while the app would show multiple people at once.
Well this was back in COVID, sometime fresh after the always-open-port news had surfaced. Can easily believe the experience has been improved since then.
I notice the browser version is a little resource intensive. I use it on freebsd and I need to renice the browser to -10 for it to be somewhat stable. (This is an improvement because I remember 6 years ago it didn't work on freebsd.) I ran it on a Mac last week and it spun the fan more than I'd expect.
Last time I looked at their web client, it was indeed doing absurd things (I think it used TCP and web sockets to carry video instead of WebRTC and shipped a WASM video codec that obviously can’t be GPU/hardware accelerated).
Not sure if that’s malice (to nudge people towards using their invasive desktop app) or incompetence.
I recently had to use the browser and was shocked to find there was no option for Gallery View. You were just stuck with one square in the middle that would bounce between different faces. I feel like they have the worst web experience out of all the meeting apps.
I always try to use browser versions of things, but zoom just hasn't worked for me in it for changes. No error messages or anything, just insistence on downloading the app. I assumed they got rid of it but I guess not.
I worked at Zoom during this time. That's not what happened.
Zoom used the same technique Cisco Webex did - they ran a webserver with an open port so that local "links" to a meeting could open on your own machine. It wasn't a backdoor. Apple flagged that as a potential security risk, so Zoom worked with Apple on how to safely remove only the webserver without affecting other functionality. We were happy that Apple worked with us on this.
However, I thought it was very interesting (and strange) that there was almost no reaction from the tech community that Apple had software running on every Mac that allowed them to remove any binary they wished. (Which sure sounds like a backdoor)
Apple did block the app so the 'working with Apple' didn't exactly earn Zoom a lot of trust with them otherwise they wouldn't have done it. They'd have let Zoom fix it in an update. And just make that update mandatory. They were just looking out for their own customers in limiting the impact, but for them to pull this handbrake means they really saw this as a big risk.
'But Cisco did it too!' is just whataboutism. It was shown to be exploited (IIRC to open scam websites) which was a real backdoor and a legitimate security risk, not a potential one.
This is something that should never have happened in the first place. Even releasing something like this in the first place is really showing no concern for the security of customers at all. What it looks like to me is that zoom wanted to conquer the market by ease of use and was willing to sacrifice security to do it. The zoombombing thing was another example.
And yes Apple has an emergency brake for malware outbreaks. And they've only used that one for high profile apps once, for zoom. They didn't do that lightly, especially during the pandemic when people were depending on it.
Really I have no good words for the actions of zoom. And there have been more incidents.
I was involved in mitigating these screwups in my work, what we did was flag zoom as malware ourselves so it automatically got removed from every company machine. And block it from being installed by the user. This block is still in place.
Ps I'm sorry if I sound harsh but zoom has caused several security worries at work and we don't even use it.
A whataboutism that makes a legitimate point. It isn't reasonable to dismiss something just because a person makes a comparison. It's valid to consider that Apple might have been applying inconsistent standards and unfairly targeting Zoom for some reason.
I doubt they were being unfair but it is a bad practice to dismiss an argument because someone has the temerity to expect consistent standards. The threat of Apple arbitrarily removing apps based on unreliable reasoning is concerning.
> Ps I'm sorry if I sound harsh
Actually, thanks, that did go a long way.
It's not whataboutism, I'm not trying to distract from the point, I'm saying there was _prior art_ in the industry where customers appeared to tolerate this.
There was another PM on the team who felt the same way I did and we basically both wagged our fingers and said "you should have asked people during install", but who cares, it was too late.
Zoom had, I will say, a very... Chinese culture around software security. If you're familiar, Chinese software is often much more interested in just getting the job done in a simple way, and security is... not the job? I've used a lot of Chinese software that just wants full admin everything so no one had to learn about permissions.
Zoom wasn't exactly run that way, but the pool they hired from had a lot of that mentality in it.
I thought Apple's tool was ridiculous though. It's like "oh, some trash blew into our yards from the neighbor's trashcan" so Apple replies "oh, don't worry, I destroyed it with my orbital ion cannon" and the tech community never stops to wonder if maybe it's a little strange that Apple has an orbital ion cannon and maybe we should ask some questions about the ion cannon.
Asked people what during install? From my perspective this should have never been designed this way. I understand if you're a PM, but those engineers should've known better, Chinese or not.
As for the ion cannon (signed and notarized apps) people do talk about this and question it. Apple's infamous walled garden. Europe is trying to fix this with the Digital Markets Act (DMA) and the USA is trying to fix this with the right to repair.
But you have to admit, in this instance with Zoom, it was used for a just purpose. Apple protected end-users against bad code from Zoom, which from your post, seemed complacent.
> I thought Apple's tool was ridiculous though. It's like "oh, some trash blew into our yards from the neighbor's trashcan" so Apple replies "oh, don't worry, I destroyed it with my orbital ion cannon" and the tech community never stops to wonder if maybe it's a little strange that Apple has an orbital ion cannon and maybe we should ask some questions about the ion cannon.
Nah, that's very on brand with Apple. The Apple ecosystem is well-known to be a walled garden where they rule and are very stringent about separation to the outside and being in control. People who use Apple products know what they are getting into.
> that there was almost no reaction from the tech community that Apple had software running on every Mac that allowed them to remove any binary they wished. (Which sure sounds like a backdoor)
Because that’s a documented feature (malware protection).
As a user, I generally like it, and in this case I’m fully aligned with their classification of Zoom’s behavior as a nuisance. A lot of malware developers justify their behavior as “just doing what their users want/need”.
> A few years back, there was something about gaining root on MacOS via Zoom due to shady execution on their end.
> There's no legitimate use for it accessing privileged or private paths.
Well, that was the whole premise that made Zoom popular in the first place! It was a true one click install which made onboarding frictionless for non-technical users
Security wise, it's insane but user experience wise, it was unbeatable and is what solidified their position. It's ironic nowadays that all of those tricks have been stripped away, making it just as painful as any other platform to install on a fresh machine.
Unfortunately making software easy to install also makes it easier for Malware to be installed. It's a classic dilemma that is only fixable by making the user think twice about running stuff from the internet: Unix requires making the file executable, Windows at some point started tagging downloaded files with an "untrusted" attribute.
Question - How does this capture the entire screen, except its own window?
I've tried making similar functionality in Python to add visual effects to the screen, but the only way I found is to use one of the packages which leverage the Screenshot functionality.
But this causes recursion since my app's window will be in the screenshot (unless I put my app on a different monitor or a different area of the monitor). How do they avoid that?
That could be, although I'd guess obscurity in this case might reduce the likelihood of random mentally ill people minor threats, and also reduce the likelihood of being the chosen target of some more capable terrorist threat.
(Even random mentally ill people are likely to have access to firearms, and maybe heavy vehicles.)
Before cloud got big, I used to have a personal physical server colocated at a network facility, in a nondescript commercial building that you had to know was there, and turn off the main street to get to, with no signage I could see. (Also, biometrics scanners, when those weren't consumer things, and a waiting room that seemed to securely lock in visitors, in view of guards.)
I'd previously heard of non-government buildings without signage, for security reasons, so I figured that was it. Rather than not wanting to spend the money on a sign that would make it easier for customers to physically find, increase brand awareness, or raise their prominence in the minds of local officials before whom they might occasionally have business.
And, over time, you hear of other non-government unmarked buildings that are arguably "sensitive", for one reason or another. The ones that personally come to mind, historically that type has been threatened before (by, e.g., people angry at a company that they blame for automating away jobs, people who saw a movie involving blowing up records of bank loans and think that will work in real life, animal rights activists who want to free lab animals (and didn't see that other movie), eco-terrorists, people who are are mentally ill and found something conveniently located to fixate on). Maybe also no need to invite protestors?
Once went to visit a Raytheon technical support guy in his office. He made a point that it was 'hard to find' and there 'were no signs'. And he was right. Drive to a building. Park. List of business but not Raytheon. Go through a door that looks like it should be locked. Down a hall to the end. Open a door that looks like a utility closet and there is their office.
Company Policy.
Old office in SF two floors were a banking operation. They weren't on the signage. And you'd get in the elevator with people that worked on those floors and they would stand silently despite obviously knowing each other. Double set of doors on those two floors.
I think you're right about obscurity preventing a lot of low-grade issues.
There's an interesting building right in downtown Minneapolis that takes up an entire block that I'd passed several times a week for years without even noticing it—it's the operations center for Wells Fargo (and actually it just recently has been sold).
Zero signage and very nondescript, but when I found out what it was some of the physical security around it started to become super obvious. Big bollard "planters" and protection from large vehicles, a lot of cameras, no real obvious lobby.
Dead on.
Another good example is the London Stock Exchange; they have a really nice office downtown that is something of a magnet for protests, but I used to work around the corner from their data centre , and it was in a very scruffy , anonymous building with dirty windows, just an unusual number of cameras and stuff on the roof.
> security by obscurity is weak for actual security
There was a time when I believed this. But over the years, I've concluded that in many cases, that which is considered legitimate security is in fact rooted simply in ensuring that the attacker is lacking information, which is fairly synonymous with obscurity.
Secrecy is a core part of legitimate security. But mere obscurity is not secrecy. In a secure system design you know exactly which parts are secret and which are not.
Yes, ideally this distinction can be made. But a piece of information you consider secret, if known by more than exactly one person, is merely obscure information.
A few years back, there was something about gaining root on MacOS via Zoom due to shady execution on their end.
They've lost my trust since then, and I'll only run it sandboxed: https://gist.github.com/cielavenir/02f322e322a2a3555dbf2b38f...
I always ask (1) why does an app require installation and (2) why would it require root?
There are valid answers for both, but realistically, all a videoconferencing app should need (apart from audio and video and maybe screen sharing) is to store a config file.
There's no legitimate use for it accessing privileged or private paths.
reply