←back to thread

Zoom needs to clean up its privacy act

(blogs.harvard.edu)
1597 points seapunk | 1 comments | 27 Mar 20 14:18 UTC | HN request time: 0s | source
Show context
luminati ◴[27 Mar 20 22:35 UTC] No.22707528[source]▶
Honest question [not trying to act controversial], especially with all the US-China spat.

Zoom's engineering team is based in China - the product is primarily built out of there. [1]

What guarantee is there that the CCP is not intercepting/backdooring all video communications? Especially in current situations, where so much sensitive information is being discussed via Zoom?

[1] https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...

replies(5): >>22707715 #>>22707724 #>>22707911 #>>22708147 #>>22708479 #
kccqzy ◴[28 Mar 20 00:30 UTC] No.22708147[source]▶
I really hate to mention this, but this perhaps answered an question of mine about why quality of code in Zoom is so low.

When I installed Zoom for Mac for the first time, I noticed it took a while to start up and caused beachballing. So I grabbed a sample of the process via Activity Monitor. To my utter horror, the Zoom binary is shelling out by calling system(3) on the fucking main thread.

I just verified this is the case on the latest version of Zoom for Mac. The binary zoom.us.app/Contents/Frameworks/zmLoader.bundle/Contents/MacOS/zmLoader invokes system(3) on three separate occasions in two functions: -[ZPMBSystemHelper disablePTAutoRestoreWindow] and -[ZPMBSystemHelper disableConfAutoRestoreWindow].

And looking at what the string was, it's just a fucking call to defaults(1). Now I'm not a Mac programming expert but I cannot understand why Zoom needs to change its own preference settings this way. This just screams sloppy software engineering quality. I guess this is what you get when you outsource software engineering.

I would not be surprised at all if someone reports vulnerabilities in Zoom, whether deliberate or accidental.

replies(2): >>22708344 #>>22709807 #
1. saagarjha ◴[28 Mar 20 07:38 UTC] No.22709807[source]▶
Aaaaaaahhhh this is just so horrible. There is specific in-process C and Objective-C API for this. Someone should look at this app. Maybe I will if I finish up what I’m doing.