9 ms·

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyo

So it sounds like Zoom was using the Facebook SDK, and now they're not. I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with. Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone. Or having no way to package open source software where you can actually see what's running. As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about. Yeah maybe you can pass laws about it. But is that really a great solution? Who audits that? How do you determine what's legal and what's not? We should be pushing for a platform that makes it obvious what the software you're running is up to. The random pitchfork crusade against whatever company happens to catch a bad news cycle just isn't going to get us anywhere.

aaronbrager 7y ago
You can pretty easily see all the traffic on your own phone. You can even do it on device https://apps.apple.com/us/app/charles-proxy/id1134218562 https://apps.apple.com/us/app/charles-proxy/id1134218562
- JMTQp8lwXL 7y ago
  Seeing it != blocking it.
  - jbigelow76 7y ago
    If you can see it you can make an informed choice if the tradeoff is worth it.
    - shakna 7y ago
      If you can see it, but can't block it, then you've already lost a part of it before you can make that informed decision.
      - Zenbit_UX 7y ago
        Of course you can block it, a private DNS with ad blocking is trivial to setup. Knowing about it is far important as you can make informed decisions.
  - pimeys 7y ago
    You basically need your own VPN server with Pi-hole installed to control the tracking. It is a very effective way to block this, but not that easy to setup.
    - Fnoord 7y ago
      If you can use NextDNS, you have something akin to a Pi Hole.
  - dewey 7y ago
    So https://guardianapp.com https://guardianapp.com then?
- bscphil 7y ago
  Does this work with apps that do their own TLS using their own pinned certs? I don't see how it could. Surely that's a lot of high profile apps these days. If this app works without root, it must be possible to apps on iPhone to add their own certificates to the system, which are then trusted by other applications - that would already be pretty alarming. I think Android still requires certificates to be manually imported by the user. Maybe this app points you to instructions on how to do this, but the description makes it sound very automatic.
  - saagarjha 7y ago
    No, you’d need to jailbreak or modify the application for that.
  - azinman2 7y ago
    You can add an ssl certificate but if they do cert pinning then it breaks. Most don’t do cert pinning.
  - youngtaff 7y ago
    If you've got a Jailbroken phone, this post explains how to extract the TLS keys (to decrypt the traffic) using a Frida script https://andydavies.me/blog/2019/12/12/capturing-and-decrypting-https-traffic-from-ios-apps/ https://andydavies.me/blog/2019/12/12/capturing-and-decrypti...
    - bscphil 7y ago
      For sure, it can be done, I was just thinking that MITMing yourself on iPhone is not so easy these days as just installing this one app.
- Zenbit_UX 7y ago
  If you can set your own DNS on iOS why not just use something like nextDNS.io?
  - cerberusss 7y ago
    NextDNS is fantastic. I use it to block ads on my iPhones and iPads.
designcode 7y ago
You can easily see all traffic on your device, try Charles proxy.
intopieces 7y ago
>Getting mad at Zoom for using the Facebook SDK is missing the point. It's really hard to believe this point given that... getting mad seems to have worked.
- JMTQp8lwXL 7y ago
  Doesn't scale. We can't have 1,000,000 front page "App X uses Y SDK" posts. People will stop caring. Nobody's made a post of that flavor in awhile, and Zoom got caught in the crossfire. Honestly, if anything it shields other apps. People have a limited capacity for repeatedly addressing the same thing.
  - kyawzazaw 7y ago
    I think it doesn't always have to scale. Zoom is a huge player right now and in great usage across all industries, countries and users.
    - JMTQp8lwXL 7y ago
      That's a great point. The 80-20 rule likely applies here. Of all instances of beaconing events, the bulk of those events originate from a small number of popular apps.
    - pjmlp 7y ago
      Really?!? If it wasn't for this post I wouldn't even know that they exist.
      - kyawzazaw 7y ago
        What industry do you work in and what country are you in right now?
        pjmlp 7y ago
        Fortune 500 consulting, European Union market. Webex, Teams, Slack are the only ones that matter.
nexuist 7y ago
I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent. Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private. Blaming Apple? Why, when Zoom is on the Play Store as well? https://play.google.com/store/apps/details?id=us.zoom.videomeetings&hl=en https://play.google.com/store/apps/details?id=us.zoom.videom... >As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about. Surely there are open source video chat solutions already? They haven't taken off for one simple reason: video hosting is expensive. It's quite literally one of the most intensive network activities you can partake in, rivaling torrenting. It doesn't make sense economically to offer a video hosting platform without collecting income from it. Nor does it make sense to attempt a peer-to-peer solution knowing full well that one laggy peer wrecks the experience for everyone else. It's a very hard problem.
- judge2020 7y ago
  > Blaming Apple? Why, when Zoom is on the Play Store as well? Blame Apple because they constantly tout the iPhone as being "privacy respecting" and "what happens on your iPhone stays on your iPhone"[0], while they A. Apple doesn't default to "limit tracking", or at least make "limit tracking" an option on setup/iOS upgrade B. Apple doesn't penalize developers for using Facebook's SDK with auto data collection (ie. punishment by having text like "sends data to: facebook, google, hotjar" on an app's install page) C. Apple doesn't do any software stuff to limit and track the trackers. Having a counter for # of total days a domain name was contacted would be an eye-opener for many, and being able to toggle a "block" on the domain would be a big step forward. Facebook meets the standard for being included in apps (respects the user resetting the usage ID), but that standard isn't the standard privacy-conscious users want. Apple can do better, but whether it be industry pressure or monetary pressure [google paying to be the default search engine], they don't actually put privacy first. 0: https://www.businessinsider.com/apples-ces-ad-las-vegas-misleading-2019-1 https://www.businessinsider.com/apples-ces-ad-las-vegas-misl...
  - 7y ago
marta_morena_23 7y ago
Baffling how this can be the top post... "Who audits that?" We just did. And if there was a law against that, Zoom would just have been exposed for breaking it. Any sane company will try their best to adhere to laws. Some big players like Google can afford to mess around pay a few billions in fines, but those are the exceptions, not the rule. Eventually, even they can't afford to pay the fines in the long run (Even Google bowed to GDPR or at least its getting bashed with steeper fines until they wake up). "How do you determine what's legal and what's not?" You pass a law, read the law? This is a self-contradiction. Laws are open for interpretation but the interpretation is quite clear after a supreme court case (for the better or worse). "We should be pushing for a platform that makes it obvious what the software you're running is up to". Oh the web of trust? Did you ever install Snitch or some other firewall on your system? Its utterly hopeless even if you are knowledgeable. There is simply not way to audit that. Who audits that? Here you CAN ask this question. I can't for the life of me understand how you can believe that it is better for everyone, including parents and grandparents to audit their phone, instead of having researchers audit phones and report companies who break the law. This is non-nonsensical. You must either be some expert without a connection to the real world, or some elitist who thinks everyone is like him.
- frereubu 7y ago
  > Baffling how this can be the top post Specifically on this point, I think the HN comment sorting algorithm may take account of how many votes child comments have too, so you may find that it’s the top child comment which has brought this to the top.
crtlaltdel 7y ago
yeah same here, on web and mobile this is super common. i just went through this with a PM.
tbodt 7y ago
Get mad at Facebook for stuffing analytics into their login button library
- joelhaasnoot 7y ago
  Note that the functionality is actually attribution for the app adds platform on Facebook. If you run ads on FB for an app, this ensures installs are tracked, and doesn't show the user the ad if they already have it.
saagarjha 7y ago
> Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone. There’s plenty of anger to go around. Get mad all all three: Facebook for making an SDK that tracks you, Zoom for integrating it, and Apple for letting it through unencumbered.
- fortydegrees 7y ago
  I can't tell if your comment is intentionally funny, but I got a good laugh out of it.
  - saagarjha 7y ago
    I wasn't trying to; what about it did you find humorous?
- LeoNatan25 7y ago
  Do you know what developer uproar there would be if Apple decided to block all Facebook SDK usage? Surely you know most anger will be targeted at Apple, rather than FB.
anyfoo 7y ago
Of course passing laws about that is a great solution. This is how society defines what is and what isn’t acceptable behavior for corporations. Are you also typing up rallying paragraphs against laws that dictate how companies have to adhere to food safety? Would your suggestion then be to “get mad at Burger King for not allowing you to perform chemical tests in the restaurant”? “Everyone does it”, like everyone used asbestos and lead pipes in the past?
- jgimenez 7y ago
  I agree laws help, but well done laws. Not another cookie consent mess again, please.
angrygoat 7y ago
You obviously need be a highly technical user, but it ought to be fairly easy for most people here to run a packet capture on their phone: https://developer.apple.com/documentation/network/recording_a_packet_trace https://developer.apple.com/documentation/network/recording_...
Causality1 7y ago
Constantly having to be in a war against my own phone's operating system is exhausting. These days I absolutely refuse to buy any brand that makes me jump through hoops just to get root on my own silicon.
hyko 7y ago
Yes, we need laws against this and for the gatekeepers to be the enforcers. I used to think that individual choice would solve these problems, but it won’t. Zoom et al are growing like a weed and we can’t protect all our loved ones from this bullshit with individual action all of the time. There are some problems that require government action; I think the events of this year have demonstrated that clearly. Individually we are weak as water, but collectively we are embarrassingly powerful. Time to organise.
peteretep 7y ago
> Who audits that? I’d like to see Apple launch their own telemetry/events framework, that users can examine the data from, and then cut off everyone else
Angostura 7y ago
> Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone. But you’ve just said everyone does it and we shouldn’t get mad at them - so we don’t need wireshark, because it would simply confirm that everyone does it and we shouldn’t get mad at them - right?
hamburglar 7y ago
I'm really liking Zoom's responses to incidents lately. Both this and the "oops we implemented certain features by leaving a localhost webserver gaping open" fiasco fairly recently got extremely nimble responses from them, and the responses were absolutely the right thing to do. They could have hand-waved the http server away and claimed to have "secured" it, and they could have hand-waved this away as "standard practice", which, let's be frank, it almost certainly is. The fact that they understood the seriousness and swiftly yanked the features in both instances is HUGE. Kudos to them for this. edit: some people won't want to give them any slack because they committed the offenses in the first place, but I think that's silly. Reward them for trying, because if this is the way they're going to respond to blowing it, they're one of the good guys.
- minusf 7y ago
  in the end they did the right thing with the local web server, but iirc their first response was "this is a non issue and needed for proper operation". a definite improvement in this case and so far.
  - hamburglar 7y ago
    I agree that they started out kinda shitty on the web server thing, but they corrected pretty decisively. The web server was gone within days.
_trampeltier 7y ago
But there could be a law, Apps have to have an option to write all telemetric data to a text file.
rpastuszak 7y ago
> As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about. PWAs could answer this problem, at least to some extent, but Apple historically has been limiting the features to protect the AppStore and the Apple Tax (v. the recent local persistence changes in ITP). It's better than, say, Google pretending that third-party cookies make the web a safer place (yup, that happened). (Don't get me wrong, I think ITP and Safari are great) > Get mad at Apple for not letting you wireshark your own iPhone. People on HN can, but an average user shouldn't have to care about that. I'm 100% up for stronger legislative measures (both tech and dark UX patterns) and more education in this area. Sounds boring, but without it we'll just keep running in circles.
StreamBright 7y ago
>> I can tell you from experience that everyone does this. This is not true and even if it was true it is an extremely lame argument. You can justify pretty much everything with this logic.
pixelrevision 7y ago
Another problem is these analytics platforms just keep getting worse. There used to be a lot of effort put in to not collecting any personally identifiable info. Hell even google analytics was strict about that. It also took time to integrate them. Now almost all the packages grab identifiable info by default and some are doing things like making screen recordings. Combine that with a rotating set of product owners like described above and a lot of apps just end up making way too many calls to way too many places. And I do think Apple could and should be doing something more here. Their developer analytics setup is a good example to lead by as it gives users a global option to opt out. They also are able to reject apps for an icon being offbrand so I’m pretty sure they could figure out something here.
jka 7y ago
When you say 'everyone' in your second paragraph, really you mean 'all of the Silicon Valley style employers I'm aware of'. That's a tiny proportion of the user population and doesn't imply agreement or consent to the information the Facebook SDK shares. And even if it it did, it wouldn't automatically mean that it's an acceptable or good behaviour by those apps and Facebook. Bringing widely-distributed privacy breaches to a wider audience's attention can help those users provide feedback regarding products and then allow them to select vendors who respect their values.
jtdev 7y ago
Don’t blame the drunk driver, blame the auto manufacturer...
HenryBemis 7y ago
Hello fellow iOS developer. I have two apps on the Apple store. I never used any external SDK/libraries, only the built-in Xcode ones. I preferred to spent a bit more time in writing/testing but I would never accept that FB and other scum (privacy standpoint) track children (I wrote the apps for my nephews and nieces and I put them in the Apple store just for them)(I don't advertise them at all and I won't do so here either). Regarding the issue that started this Zoom-FB dialogue I have commented a dozen (or more) times on the necessity to have a firewalled phone that a user (unfortunately the user needs to have basic knowledge of firewall admin) can decide what to allow and what to block. Your point on who audits is valid (I am a CISA and CISM of many years), and, well, nobody does. Each user will have to do his/her own work/effort to keep their family clear of these scum.
PrettyPastry 7y ago
You can listen to the iPhone with wireshark using OWASP zap as a proxy.
m463 7y ago
Nice to see someone who gets it. Apple gives you no way to find what your phone is doing, and no way to prevent it from doing it. They provide company sponsored "controls" on what apps can do, which is about as useful as a factory alarm on a mid-80's car. Except with a modern twist, where they're the only ones capable of installing an alarm. (and imagine the alarm gives a free pass to apple) The fact that they're starting in on MacOS and Little Snitch makes me think their platform isn't long for the world. sigh. I do like arch linux.
mliker 7y ago
It doesn’t “sound like” that, it’s literally what they’re admitting to. Let’s not spin the narrative here on HN that Zoom didn’t admit to their faults.
madwhitehatter 7y ago
No, they don't? There are very few companies that record your phone calls/video calls, then transcribe them into text. Then store the data for themselves. This includes any data that we shared in the session. Why can't Zoom just come out and explain why they do this? Seems pretty simple. If you asked me?
neycoda 7y ago
Steve Jobs made Apple about the user. Tim Cook is just leveraging that to make it all about the money.

aaronbrager 7y ago

You can pretty easily see all the traffic on your own phone. You can even do it on device https://apps.apple.com/us/app/charles-proxy/id1134218562 https://apps.apple.com/us/app/charles-proxy/id1134218562

JMTQp8lwXL 7y ago
Seeing it != blocking it.
- jbigelow76 7y ago
  If you can see it you can make an informed choice if the tradeoff is worth it.
  - shakna 7y ago
    If you can see it, but can't block it, then you've already lost a part of it before you can make that informed decision.
    - Zenbit_UX 7y ago
      Of course you can block it, a private DNS with ad blocking is trivial to setup. Knowing about it is far important as you can make informed decisions.
- pimeys 7y ago
  You basically need your own VPN server with Pi-hole installed to control the tracking. It is a very effective way to block this, but not that easy to setup.
  - Fnoord 7y ago
    If you can use NextDNS, you have something akin to a Pi Hole.
- dewey 7y ago
  So https://guardianapp.com https://guardianapp.com then?
bscphil 7y ago
Does this work with apps that do their own TLS using their own pinned certs? I don't see how it could. Surely that's a lot of high profile apps these days. If this app works without root, it must be possible to apps on iPhone to add their own certificates to the system, which are then trusted by other applications - that would already be pretty alarming. I think Android still requires certificates to be manually imported by the user. Maybe this app points you to instructions on how to do this, but the description makes it sound very automatic.
- saagarjha 7y ago
  No, you’d need to jailbreak or modify the application for that.
- azinman2 7y ago
  You can add an ssl certificate but if they do cert pinning then it breaks. Most don’t do cert pinning.
- youngtaff 7y ago
  If you've got a Jailbroken phone, this post explains how to extract the TLS keys (to decrypt the traffic) using a Frida script https://andydavies.me/blog/2019/12/12/capturing-and-decrypting-https-traffic-from-ios-apps/ https://andydavies.me/blog/2019/12/12/capturing-and-decrypti...
  - bscphil 7y ago
    For sure, it can be done, I was just thinking that MITMing yourself on iPhone is not so easy these days as just installing this one app.
Zenbit_UX 7y ago
If you can set your own DNS on iOS why not just use something like nextDNS.io?
- cerberusss 7y ago
  NextDNS is fantastic. I use it to block ads on my iPhones and iPads.

designcode 7y ago

You can easily see all traffic on your device, try Charles proxy.

intopieces 7y ago

>Getting mad at Zoom for using the Facebook SDK is missing the point. It's really hard to believe this point given that... getting mad seems to have worked.

JMTQp8lwXL 7y ago
Doesn't scale. We can't have 1,000,000 front page "App X uses Y SDK" posts. People will stop caring. Nobody's made a post of that flavor in awhile, and Zoom got caught in the crossfire. Honestly, if anything it shields other apps. People have a limited capacity for repeatedly addressing the same thing.
- kyawzazaw 7y ago
  I think it doesn't always have to scale. Zoom is a huge player right now and in great usage across all industries, countries and users.
  - JMTQp8lwXL 7y ago
    That's a great point. The 80-20 rule likely applies here. Of all instances of beaconing events, the bulk of those events originate from a small number of popular apps.
  - pjmlp 7y ago
    Really?!? If it wasn't for this post I wouldn't even know that they exist.
    - kyawzazaw 7y ago
      What industry do you work in and what country are you in right now?
      - pjmlp 7y ago
        Fortune 500 consulting, European Union market. Webex, Teams, Slack are the only ones that matter.

nexuist 7y ago

I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent. Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private. Blaming Apple? Why, when Zoom is on the Play Store as well? https://play.google.com/store/apps/details?id=us.zoom.videomeetings&hl=en https://play.google.com/store/apps/details?id=us.zoom.videom... >As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about. Surely there are open source video chat solutions already? They haven't taken off for one simple reason: video hosting is expensive. It's quite literally one of the most intensive network activities you can partake in, rivaling torrenting. It doesn't make sense economically to offer a video hosting platform without collecting income from it. Nor does it make sense to attempt a peer-to-peer solution knowing full well that one laggy peer wrecks the experience for everyone else. It's a very hard problem.

judge2020 7y ago
> Blaming Apple? Why, when Zoom is on the Play Store as well? Blame Apple because they constantly tout the iPhone as being "privacy respecting" and "what happens on your iPhone stays on your iPhone"[0], while they A. Apple doesn't default to "limit tracking", or at least make "limit tracking" an option on setup/iOS upgrade B. Apple doesn't penalize developers for using Facebook's SDK with auto data collection (ie. punishment by having text like "sends data to: facebook, google, hotjar" on an app's install page) C. Apple doesn't do any software stuff to limit and track the trackers. Having a counter for # of total days a domain name was contacted would be an eye-opener for many, and being able to toggle a "block" on the domain would be a big step forward. Facebook meets the standard for being included in apps (respects the user resetting the usage ID), but that standard isn't the standard privacy-conscious users want. Apple can do better, but whether it be industry pressure or monetary pressure [google paying to be the default search engine], they don't actually put privacy first. 0: https://www.businessinsider.com/apples-ces-ad-las-vegas-misleading-2019-1 https://www.businessinsider.com/apples-ces-ad-las-vegas-misl...
- 7y ago

marta_morena_23 7y ago

Baffling how this can be the top post... "Who audits that?" We just did. And if there was a law against that, Zoom would just have been exposed for breaking it. Any sane company will try their best to adhere to laws. Some big players like Google can afford to mess around pay a few billions in fines, but those are the exceptions, not the rule. Eventually, even they can't afford to pay the fines in the long run (Even Google bowed to GDPR or at least its getting bashed with steeper fines until they wake up). "How do you determine what's legal and what's not?" You pass a law, read the law? This is a self-contradiction. Laws are open for interpretation but the interpretation is quite clear after a supreme court case (for the better or worse). "We should be pushing for a platform that makes it obvious what the software you're running is up to". Oh the web of trust? Did you ever install Snitch or some other firewall on your system? Its utterly hopeless even if you are knowledgeable. There is simply not way to audit that. Who audits that? Here you CAN ask this question. I can't for the life of me understand how you can believe that it is better for everyone, including parents and grandparents to audit their phone, instead of having researchers audit phones and report companies who break the law. This is non-nonsensical. You must either be some expert without a connection to the real world, or some elitist who thinks everyone is like him.

frereubu 7y ago
> Baffling how this can be the top post Specifically on this point, I think the HN comment sorting algorithm may take account of how many votes child comments have too, so you may find that it’s the top child comment which has brought this to the top.

crtlaltdel 7y ago

yeah same here, on web and mobile this is super common. i just went through this with a PM.

tbodt 7y ago

Get mad at Facebook for stuffing analytics into their login button library

joelhaasnoot 7y ago
Note that the functionality is actually attribution for the app adds platform on Facebook. If you run ads on FB for an app, this ensures installs are tracked, and doesn't show the user the ad if they already have it.

saagarjha 7y ago

> Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone. There’s plenty of anger to go around. Get mad all all three: Facebook for making an SDK that tracks you, Zoom for integrating it, and Apple for letting it through unencumbered.

fortydegrees 7y ago
I can't tell if your comment is intentionally funny, but I got a good laugh out of it.
- saagarjha 7y ago
  I wasn't trying to; what about it did you find humorous?
LeoNatan25 7y ago
Do you know what developer uproar there would be if Apple decided to block all Facebook SDK usage? Surely you know most anger will be targeted at Apple, rather than FB.

anyfoo 7y ago

Of course passing laws about that is a great solution. This is how society defines what is and what isn’t acceptable behavior for corporations. Are you also typing up rallying paragraphs against laws that dictate how companies have to adhere to food safety? Would your suggestion then be to “get mad at Burger King for not allowing you to perform chemical tests in the restaurant”? “Everyone does it”, like everyone used asbestos and lead pipes in the past?

jgimenez 7y ago
I agree laws help, but well done laws. Not another cookie consent mess again, please.

angrygoat 7y ago

You obviously need be a highly technical user, but it ought to be fairly easy for most people here to run a packet capture on their phone: https://developer.apple.com/documentation/network/recording_a_packet_trace https://developer.apple.com/documentation/network/recording_...

Causality1 7y ago

Constantly having to be in a war against my own phone's operating system is exhausting. These days I absolutely refuse to buy any brand that makes me jump through hoops just to get root on my own silicon.

hyko 7y ago

Yes, we need laws against this and for the gatekeepers to be the enforcers. I used to think that individual choice would solve these problems, but it won’t. Zoom et al are growing like a weed and we can’t protect all our loved ones from this bullshit with individual action all of the time. There are some problems that require government action; I think the events of this year have demonstrated that clearly. Individually we are weak as water, but collectively we are embarrassingly powerful. Time to organise.

peteretep 7y ago

> Who audits that? I’d like to see Apple launch their own telemetry/events framework, that users can examine the data from, and then cut off everyone else

Angostura 7y ago

> Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone. But you’ve just said everyone does it and we shouldn’t get mad at them - so we don’t need wireshark, because it would simply confirm that everyone does it and we shouldn’t get mad at them - right?

hamburglar 7y ago

I'm really liking Zoom's responses to incidents lately. Both this and the "oops we implemented certain features by leaving a localhost webserver gaping open" fiasco fairly recently got extremely nimble responses from them, and the responses were absolutely the right thing to do. They could have hand-waved the http server away and claimed to have "secured" it, and they could have hand-waved this away as "standard practice", which, let's be frank, it almost certainly is. The fact that they understood the seriousness and swiftly yanked the features in both instances is HUGE. Kudos to them for this. edit: some people won't want to give them any slack because they committed the offenses in the first place, but I think that's silly. Reward them for trying, because if this is the way they're going to respond to blowing it, they're one of the good guys.

minusf 7y ago
in the end they did the right thing with the local web server, but iirc their first response was "this is a non issue and needed for proper operation". a definite improvement in this case and so far.
- hamburglar 7y ago
  I agree that they started out kinda shitty on the web server thing, but they corrected pretty decisively. The web server was gone within days.

_trampeltier 7y ago

But there could be a law, Apps have to have an option to write all telemetric data to a text file.

rpastuszak 7y ago

> As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about. PWAs could answer this problem, at least to some extent, but Apple historically has been limiting the features to protect the AppStore and the Apple Tax (v. the recent local persistence changes in ITP). It's better than, say, Google pretending that third-party cookies make the web a safer place (yup, that happened). (Don't get me wrong, I think ITP and Safari are great) > Get mad at Apple for not letting you wireshark your own iPhone. People on HN can, but an average user shouldn't have to care about that. I'm 100% up for stronger legislative measures (both tech and dark UX patterns) and more education in this area. Sounds boring, but without it we'll just keep running in circles.

StreamBright 7y ago

>> I can tell you from experience that everyone does this. This is not true and even if it was true it is an extremely lame argument. You can justify pretty much everything with this logic.

pixelrevision 7y ago

Another problem is these analytics platforms just keep getting worse. There used to be a lot of effort put in to not collecting any personally identifiable info. Hell even google analytics was strict about that. It also took time to integrate them. Now almost all the packages grab identifiable info by default and some are doing things like making screen recordings. Combine that with a rotating set of product owners like described above and a lot of apps just end up making way too many calls to way too many places. And I do think Apple could and should be doing something more here. Their developer analytics setup is a good example to lead by as it gives users a global option to opt out. They also are able to reject apps for an icon being offbrand so I’m pretty sure they could figure out something here.

jka 7y ago

When you say 'everyone' in your second paragraph, really you mean 'all of the Silicon Valley style employers I'm aware of'. That's a tiny proportion of the user population and doesn't imply agreement or consent to the information the Facebook SDK shares. And even if it it did, it wouldn't automatically mean that it's an acceptable or good behaviour by those apps and Facebook. Bringing widely-distributed privacy breaches to a wider audience's attention can help those users provide feedback regarding products and then allow them to select vendors who respect their values.

jtdev 7y ago

Don’t blame the drunk driver, blame the auto manufacturer...

HenryBemis 7y ago

Hello fellow iOS developer. I have two apps on the Apple store. I never used any external SDK/libraries, only the built-in Xcode ones. I preferred to spent a bit more time in writing/testing but I would never accept that FB and other scum (privacy standpoint) track children (I wrote the apps for my nephews and nieces and I put them in the Apple store just for them)(I don't advertise them at all and I won't do so here either). Regarding the issue that started this Zoom-FB dialogue I have commented a dozen (or more) times on the necessity to have a firewalled phone that a user (unfortunately the user needs to have basic knowledge of firewall admin) can decide what to allow and what to block. Your point on who audits is valid (I am a CISA and CISM of many years), and, well, nobody does. Each user will have to do his/her own work/effort to keep their family clear of these scum.

PrettyPastry 7y ago

You can listen to the iPhone with wireshark using OWASP zap as a proxy.

m463 7y ago

Nice to see someone who gets it. Apple gives you no way to find what your phone is doing, and no way to prevent it from doing it. They provide company sponsored "controls" on what apps can do, which is about as useful as a factory alarm on a mid-80's car. Except with a modern twist, where they're the only ones capable of installing an alarm. (and imagine the alarm gives a free pass to apple) The fact that they're starting in on MacOS and Little Snitch makes me think their platform isn't long for the world. sigh. I do like arch linux.

mliker 7y ago

It doesn’t “sound like” that, it’s literally what they’re admitting to. Let’s not spin the narrative here on HN that Zoom didn’t admit to their faults.

madwhitehatter 7y ago

No, they don't? There are very few companies that record your phone calls/video calls, then transcribe them into text. Then store the data for themselves. This includes any data that we shared in the session. Why can't Zoom just come out and explain why they do this? Seems pretty simple. If you asked me?

neycoda 7y ago

Steve Jobs made Apple about the user. Tim Cook is just leveraging that to make it all about the money.