I always ask (1) why does an app require installation and (2) why would it require root?
There are valid answers for both, but realistically, all a videoconferencing app should need (apart from audio and video and maybe screen sharing) is to store a config file.
There's no legitimate use for it accessing privileged or private paths.
Out of interest why do you still use the app and not just use it in the browser? I feel much more secure having it in the browser sandbox and everything I care about works in the browser.
> I noticed it because I make heavy use of a "one-shot paste" tool which fulfills a single paste request and then terminates. Handy for filling in lots of fields of a web form – queue up pastes of several different things, then go to each form field in turn and just hit paste, bam bam bam.
This sounds very useful. Is the tool available anywhere? xclip -loops doesn't seem to do the trick, or maybe it just doesn't work that way on Wayland.
I would rather have a nice popup on first attempt "this application is monitoring your clipboard, allow?", ideally with that process completely suspended while that prompt is up.
This should be behind a toggle driven by intent, rather than something allowed by default. Default stance on trust should be "don't". Open source has nothing to do with it, when a typo while installing with a package manager means you might accidentally install something else (a common attack vector).
I dumped it after realizing Xen does its damndest in preventing you from hiding VM attributes from Guest OSes.
Proxmox uses KVM, and is easy to configure a VM to make the guest think it's on bare metal.
In the proprietary software space, a LOT of things run badly or refuse to run, or license stupidity with a guest OS. So for me, spoofing bare metal is an essential part of running ilk like Windows and proprietary apps. And also, school remote testing garbage.
Srsly, all those neck beards who over simplify the problem with a flippant "don't use zoom", as if everyone has the luxury to skip every job interview and employer meeting that absolutely requires Zoom. I wish I could live in their world where every problem is solved by simply avoiding that problem.
Zoom isn't just a technical problem. It's literally malware. The list of issues they've knowingly caused and sometimes even refused to fix is endless. They have made it clear they absolutely don't care about security in any way and they've built their entire business around that.
As I work in cyber security there's no way I'll install that shit on my personal PC. Yes I could spin up a VM but I don't want to. I could probably use it over the web but that's it.
So I'd refuse and that company's reply should inform me whether I'd want to work there in the first place. If they insist their security practices will be so lax that I will be just spending my time cleaning up everyone else's mess. In fact any employer using zoom in the first place is a huge red flag.
I currently work for a huge multinational and they have the zoom client blocked through antimalware. Anyone wishing to use it with customers or suppliers must use the web version only.
This is a habit tech people fall into. "Amazon deleted my book" -> well just strip the DRM off it. "My ISP monitors me" -> well just use a VPN instead. "Ads make it hard to use the internet" -> well just use an ad blocker.
Ironically if more tech people just rawdogged the internet I think we would have more progress.
My partial solution is to have the Android Zoom client on an idle tablet. Even though it is my office VOIP phone too, I power it off when I don't have meetings scheduled.
If someone tries to demand screen sharing, I ask one of my coworkers to drive, since they've joined from their laptop already.
I only launch the Linux Zoom client when I absolutely know I'm going to need to host a meeting and demonstrate software running on my end. I feel equally disgusted about Zoom and the corporate EDR agent. I basically feel like the most likely source of compromise of my laptop is these proprietary tools forced on me from above.
The thing that worries me is SSO for work. I wish there was a completely different identity for all the work-related apps and for my payroll/benefits portal. I.e. if they want to endanger my login that manages my work product, fine, but I don't appreciate them endangering my login that manages my own compensation, tax deductions and retirement transfers, and health insurance...
Just use a browser instead of some silly client, problem mostly solved. Use X11 or Wayland or whatever else you want, for God's sake. I don't remember any god ever claiming salvation lies in abandoning the most functional display server on the market so I'll just keep on using X11. If and when Wayland or some other alternative ever becomes as useful as X11 I might hop over but for now Wayland is a solution in search of a problem as far as I'm concerned.
It takes experience to learn why people call it the "bleeding edge". GPU acceleration is often broken in a lot of distros, and it is unkind to new users that have a panic attack dropping into a CLI shell.
LightDM at least works 99% of the time, being Cross-desktop one can select a Wayland session just fine (great when it is working), or fall back to a software compositor Cinnamon Desktop when things bork after an update. =3
Fine words, until the GPU driver goes sideways in Wayland. And... I like running multi-seat headless sessions on my local LAN hosts for several reasons. =3
There is no such thing as an "X11 clipboard" that something can be written to. As the poster goes on to allude, X11 has a concept of a "selection" (a primary and a secondary one).
It goes roughly like this: when you select a text in a window, the X client tells the X server "I have the selection now", when you paste in another window, the client behind the other window asks "who has the selection?" and requests the selection contents from the other client, the data is then forwarded through the server. The client that claimed ownership has to properly handle some associated requests/events for the whole thing to work.
The key point is, there is no central "clipboard" style repository like on Windows, the client that does the "copy" is responsible for the data, the client that wants to "paste" has to talk to it. If I try to copy/paste and quit the source program before the paste, the data is gone. That's why modern desktop environments usually come with a dedicated daemon that immediately reacts to selection ownership changes, grabs the data for itself and then claims the selection ownership to emulate the Windows style behavior.
If we play devils advocate, it's possible the Zoom client tries to do just that, not trusting whatever desktop environment. I don't use this software, so I'm going out on a limb here, but I'd guess that the "Zoom Desktop Client" is just another browser in disguise? It might be actually Chromium or whatever underneath that does this?
Not the first time Zoom abuses privilege.
A few years back, there was something about gaining root on MacOS via Zoom due to shady execution on their end.
They've lost my trust since then, and I'll only run it sandboxed: https://gist.github.com/cielavenir/02f322e322a2a3555dbf2b38f...
I always ask (1) why does an app require installation and (2) why would it require root?
There are valid answers for both, but realistically, all a videoconferencing app should need (apart from audio and video and maybe screen sharing) is to store a config file.
There's no legitimate use for it accessing privileged or private paths.
Out of interest why do you still use the app and not just use it in the browser? I feel much more secure having it in the browser sandbox and everything I care about works in the browser.
99% of the time I use the browser.
However, the video quality in the browser is worse, so depending on the use case I might have to use the app (via sandbox).
It's been years since I've had to though.
Yes Apple even blocked their app because they refused to fix it. Eventually they did and unfortunately they were allowed again.
It wasn't really root as much as an open backdoor on a TCP port as far as I recall.
Unrelated to Zoom, but
> I noticed it because I make heavy use of a "one-shot paste" tool which fulfills a single paste request and then terminates. Handy for filling in lots of fields of a web form – queue up pastes of several different things, then go to each form field in turn and just hit paste, bam bam bam.
This sounds very useful. Is the tool available anywhere? xclip -loops doesn't seem to do the trick, or maybe it just doesn't work that way on Wayland.
Turns out, Wayland has wl-copy:
https://man.archlinux.org/man/wl-copy.1
(i was also interested :)
Par for the course when running a proprietary application. If doing that on Linux, can you imagine what it and others do under Windows ?
As people running Linux should know, you cannot trust proprietary applications.
I would rather have a nice popup on first attempt "this application is monitoring your clipboard, allow?", ideally with that process completely suspended while that prompt is up.
This should be behind a toggle driven by intent, rather than something allowed by default. Default stance on trust should be "don't". Open source has nothing to do with it, when a typo while installing with a package manager means you might accidentally install something else (a common attack vector).
I'm not surprised by news like this anymore. When will Linux distributions properly sandbox our applications?
Hell, our phones have had a better permission system for years.
I miss ordinary conference calling being the norm. I like having a desktop IP phone.
Qubes OS saved me, once again. On it, Zoom only has the access to an empty VM and no access to the clipboard.
Just not using that piece of trash that is zoom would work very well too in this case
What's it like using Qubes? How much friction? I wish I could use some Nix-flavored variant of the sandboxing.
I dumped it after realizing Xen does its damndest in preventing you from hiding VM attributes from Guest OSes.
Proxmox uses KVM, and is easy to configure a VM to make the guest think it's on bare metal.
In the proprietary software space, a LOT of things run badly or refuse to run, or license stupidity with a guest OS. So for me, spoofing bare metal is an essential part of running ilk like Windows and proprietary apps. And also, school remote testing garbage.
Doesn't that preclude paravirtualization drivers? Seems like a major tradeoff for daily driver desktop stuff.
That's bad news. Don't use Zoom.
That's wildly impractical advice for many.
Just use Firefox, or Chromium if you must.
Spinning up a conference host for a small office is fairly trivial =3
https://jitsi.org/downloads/
Great, til I have a job interview and they use Zoom
Spin up your own instance and ask them to join!
Srsly, all those neck beards who over simplify the problem with a flippant "don't use zoom", as if everyone has the luxury to skip every job interview and employer meeting that absolutely requires Zoom. I wish I could live in their world where every problem is solved by simply avoiding that problem.
Zoom isn't just a technical problem. It's literally malware. The list of issues they've knowingly caused and sometimes even refused to fix is endless. They have made it clear they absolutely don't care about security in any way and they've built their entire business around that.
As I work in cyber security there's no way I'll install that shit on my personal PC. Yes I could spin up a VM but I don't want to. I could probably use it over the web but that's it.
So I'd refuse and that company's reply should inform me whether I'd want to work there in the first place. If they insist their security practices will be so lax that I will be just spending my time cleaning up everyone else's mess. In fact any employer using zoom in the first place is a huge red flag.
I currently work for a huge multinational and they have the zoom client blocked through antimalware. Anyone wishing to use it with customers or suppliers must use the web version only.
This is a habit tech people fall into. "Amazon deleted my book" -> well just strip the DRM off it. "My ISP monitors me" -> well just use a VPN instead. "Ads make it hard to use the internet" -> well just use an ad blocker.
Ironically if more tech people just rawdogged the internet I think we would have more progress.
Unfortunately, experience teaches people one can't affect political policy with gadgets, or deny human nature. =3
https://harmful.cat-v.org/people/basic-laws-of-human-stupidi...
My partial solution is to have the Android Zoom client on an idle tablet. Even though it is my office VOIP phone too, I power it off when I don't have meetings scheduled.
If someone tries to demand screen sharing, I ask one of my coworkers to drive, since they've joined from their laptop already.
I only launch the Linux Zoom client when I absolutely know I'm going to need to host a meeting and demonstrate software running on my end. I feel equally disgusted about Zoom and the corporate EDR agent. I basically feel like the most likely source of compromise of my laptop is these proprietary tools forced on me from above.
The thing that worries me is SSO for work. I wish there was a completely different identity for all the work-related apps and for my payroll/benefits portal. I.e. if they want to endanger my login that manages my work product, fine, but I don't appreciate them endangering my login that manages my own compensation, tax deductions and retirement transfers, and health insurance...
Use a dedicated, otherwise empty account for job interviews.
Linux is multi-process, _multi-user_ since forever.
No need to leave a password manager, online banking, andwhatnot accessible in the background during an interview.
And yeah: stop. using. X11. For God's sake!
Wayland doesn't work stable in kde on my OS yet so I have no choice but to use X11.
However software just shouldn't be trash. No need to blame the display layer for this.
Just use a browser instead of some silly client, problem mostly solved. Use X11 or Wayland or whatever else you want, for God's sake. I don't remember any god ever claiming salvation lies in abandoning the most functional display server on the market so I'll just keep on using X11. If and when Wayland or some other alternative ever becomes as useful as X11 I might hop over but for now Wayland is a solution in search of a problem as far as I'm concerned.
It takes experience to learn why people call it the "bleeding edge". GPU acceleration is often broken in a lot of distros, and it is unkind to new users that have a panic attack dropping into a CLI shell.
LightDM at least works 99% of the time, being Cross-desktop one can select a Wayland session just fine (great when it is working), or fall back to a software compositor Cinnamon Desktop when things bork after an update. =3
>And yeah: stop. using. X11.
Fine words, until the GPU driver goes sideways in Wayland. And... I like running multi-seat headless sessions on my local LAN hosts for several reasons. =3
Ah yes Jitsi! I have been invited to meet on Jitsi 0 times.
There is no such thing as an "X11 clipboard" that something can be written to. As the poster goes on to allude, X11 has a concept of a "selection" (a primary and a secondary one).
It goes roughly like this: when you select a text in a window, the X client tells the X server "I have the selection now", when you paste in another window, the client behind the other window asks "who has the selection?" and requests the selection contents from the other client, the data is then forwarded through the server. The client that claimed ownership has to properly handle some associated requests/events for the whole thing to work.
The key point is, there is no central "clipboard" style repository like on Windows, the client that does the "copy" is responsible for the data, the client that wants to "paste" has to talk to it. If I try to copy/paste and quit the source program before the paste, the data is gone. That's why modern desktop environments usually come with a dedicated daemon that immediately reacts to selection ownership changes, grabs the data for itself and then claims the selection ownership to emulate the Windows style behavior.
If we play devils advocate, it's possible the Zoom client tries to do just that, not trusting whatever desktop environment. I don't use this software, so I'm going out on a limb here, but I'd guess that the "Zoom Desktop Client" is just another browser in disguise? It might be actually Chromium or whatever underneath that does this?