Hacker News Reader

Comment by mikenew | Hacker News Reader

So it sounds like Zoom was using the Facebook SDK, and now they're not.

I've been and iOS developer for a long time. I can tell you from experience that everyone does this. I have never worked for anyone who didn't ask for their app to include some combination of Facebook, Google, Flurry, AppCenter, Segment, Intercom, Parse, or whatever other random analytics framework the PM happens to be infatuated with.

Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone. Or having no way to package open source software where you can actually see what's running. As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about.

Yeah maybe you can pass laws about it. But is that really a great solution? Who audits that? How do you determine what's legal and what's not? We should be pushing for a platform that makes it obvious what the software you're running is up to. The random pitchfork crusade against whatever company happens to catch a bad news cycle just isn't going to get us anywhere.

View on HN

I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent.

Blaming Zoom and FB is entirely acceptable here, it is their responsibility to keep my data private.

Blaming Apple? Why, when Zoom is on the Play Store as well?

https://play.google.com/store/apps/details?id=us.zoom.videom...

>As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about.

Surely there are open source video chat solutions already? They haven't taken off for one simple reason: video hosting is expensive. It's quite literally one of the most intensive network activities you can partake in, rivaling torrenting.

It doesn't make sense economically to offer a video hosting platform without collecting income from it. Nor does it make sense to attempt a peer-to-peer solution knowing full well that one laggy peer wrecks the experience for everyone else.

It's a very hard problem.

> Blaming Apple? Why, when Zoom is on the Play Store as well?

Blame Apple because they constantly tout the iPhone as being "privacy respecting" and "what happens on your iPhone stays on your iPhone"[0], while they

A. Apple doesn't default to "limit tracking", or at least make "limit tracking" an option on setup/iOS upgrade

B. Apple doesn't penalize developers for using Facebook's SDK with auto data collection (ie. punishment by having text like "sends data to: facebook, google, hotjar" on an app's install page)

C. Apple doesn't do any software stuff to limit and track the trackers. Having a counter for # of total days a domain name was contacted would be an eye-opener for many, and being able to toggle a "block" on the domain would be a big step forward.

Facebook meets the standard for being included in apps (respects the user resetting the usage ID), but that standard isn't the standard privacy-conscious users want. Apple can do better, but whether it be industry pressure or monetary pressure [google paying to be the default search engine], they don't actually put privacy first.

0: https://www.businessinsider.com/apples-ces-ad-las-vegas-misl...

> the Facebook SDK was collecting device information unnecessary for us to provide our services.

Sorry state of Apple App security and privacy - all your apps are swarms of data collection and privacy abuses.

Apple built this world - and Apple is to blame. Zoom is to blame too. And finally individual app developers should also alert everyone on what's truly happening in their apps.

While I have zero love for any given hyper capitalistic business like Apple, Android is not any better on the whole in this space, and in some ways measurably worse (especially when you take into account what devices actually hold the largest market share)

This is true, but Apple touts how much better they are about Privacy, and charges a premium for it. Google is more up front that they make little money on the initial sale, and are dependent on advertising to make money.

> Privacy is built in from the beginning. Our products and features include innovative privacy technologies and techniques designed to minimize how much of your data we — or anyone else — can access

https://www.apple.com/privacy/features/

Apple sells privacy, brags about privacy - yet Privacy is abused in from the beginning in the store apps.

And the lesson is - you can't buy privacy but you can sell it.

No. Apple charged a premium well before they started talking about privacy.

I once had to integrate a third party tracking framework to an Android app. The PM wanted to track everything, even the apps that were installed on the device. Google immediately took our app down because of that.

And preventing this from happening with SSL pinning is not a barrier for Google or Apple because they can easily bypass that.

Since they have the means to inspect the traffic at scale then they should be able to filter out apps that are violating your privacy.

It seems whoever is gathering that info and sending it is Facebook

Blame them. Not Apple

You can't have a walled garden and not be responsible for the things that take place in it

However you have to be much more intrusive on developers if you are going to require semantic analysis of all data being sent to see if it was justified and whether it was mentioned in a (plain text, localized potentially into many languages) privacy policy.

I agree. People who send this data externally are ultimately responsible. Hypothetically, If I use the internet to steal data from my employer it’s not the network teams fault for allowing it to happen. I’m just a thief in position of trust exploiting my capabilities.

Not just that Apple has actually started to sell users' data to Goldman Sachs as well. The worst part is, this is opt-in. Not opt out. And opt out is incredibly so backward that you need to email some address instead of just clicking a button.

So I don't see how they're a "privacy respecting company" either. It's just marketing BS.

https://techcrunch.com/2020/03/24/apple-card-gets-updated-pr...

I'm not sure you read the article you linked to properly:

> Apple is changing the privacy policy for Apple Card with iOS to share a richer, but still anonymized set of data with Goldman Sachs in order to allow the creation of a new credit assignment model, which could expand the group of users that may be able to secure credit. > There is also a beefed up fallback method in the works that will allow users to share more personal data on an opt-in basis with Goldman Sachs if you do not at first get approved

So anonymised by default.

Opt-in, IF you want to share more personal data.

Do you also understand it's Goldman Sachs that run the credit cards, accounts, etc, they're not just randomly sharing data with Goldman Sachs?

It’s an opt-out:

“You can opt out of this use or your Apple relationship information by emailing our privacy team at dpo@apple.com with the subject line ‘Apple Relationship Data and Apple Card.’”

Opt-out of sending anonymised data, to the company providing the credit service.

It doesn't matter how anonymized they claim it to be, it should be opt-in, not opt-out. Of course virtually nobody would choose to opt-in, which is the point.

> it should be opt-in, not opt-out

Sure, it would be nice if no company ever shared data with any other company, but that does not track in this case.

People signing up for an Apple branded Goldman Sachs credit card shouldn't be surprised or affronted by the fact Goldman Sachs gets anonymised data from Apple.

Why the hell anyone would sign up for this crap is beyond me. But it's not a reason to drag Apple into the context of a thread about a company guilty of basic privacy failures -- sending personal data to a 3rd party social network the user has no connection to.

Please also understand what 'anonymised' means, it means _not reversible_ i.e. you _cannot_ tell who the user is.

Have you never heard of deanonymization? In many cases you most certainly can. https://arxiv.org/pdf/1902.09897.pdf

Of course, but that suggests Apple isn't smart enough to know this and hasn't sufficiently anonymised the data, which is pure speculation?

Agreed. Apps on iOS (IMO) should have to declare what domains they'll access and otherwise get no other network access with special exceptions for browsers and network tools. I hope Apple will prevent apps from seeing SSIDs. I also hope Apple will come up with some similar solution for bluetooth so that apps can only see the devices the user selects and not just scan for all devices.

> declare what domains they'll access and otherwise get no other network access

So Facebook will just provide an SDK for app developers to integrate server-side that lets their app send the data to their own domain, and the server passes it on to FB. Developers will install it, because they want the analytics and ad conversion tracking. There probably isn't a great technical solution to this problem.

This would be leagues better than what we have now since we know that (at least a handful of) companies don't know or actively audit what their SDKs are doing - the Zoom situation here has plausible deniability. If they requires some server-site SDK to do this, some/many would do it, but that increases the cost of running the SDK and there wouldn't be any way to say "we didn't know FB used us as a privacy trojan".

Apple's browser is privacy respecting. The app universe is still the wild west. IDFA is terrifying because you can do out-of-band lookups with third parties and you'd NEVER KNOW. At least with cookies you can trace the information flows.

Just to take you up on possible FOSS solutions: If anyone is looking for a private and open source video chat platform self-hosting NextCloud [0] might be worth a try.

[0]: https://nextcloud.com/talk/

Jitsi.org was discussed here recently as well.

http://jitsi.org

Cant you put just the dysfunctional peer behind the expensive network magic?

Why not blame Facebook for being the most data hungry and privacy disrespecting for-profit entity ever known to man? (Google is tied for that spot, Microsoft close third)

It‘s a little bit like blaming the person making the deal with the devil. Of course on some level they deserve blame for engaging with evil but evil presenting itself in a slick interface should also get its fair share.

Yes, Facebook deserves blame for automatically sending all those things to them, even if an app only wants to provide optional Facebook login for users who opt in.

However every app vendor by now should know that Facebook is hungry for data and careless use of Facebook software is to blame in them.

As is Apple (and Google) to blame for providing no privacy measures for users.

Little Snitch seems to have solved it fairly well on macOS.

Apple doesn’t allow software like that on iOS.

i wonder if apple configurator “filtering” profile [0] could be used?...

[0] https://support.apple.com/en-is/guide/mdm/mdmc77c9609/1/web/...

maybe some kind of automated little snitch settings ⇄ profile converter?

The problem is the lack of notification/visibility into what hosts to which the app is connecting.

It’s possible that your solution might work for some small fraction of users, some of the time, for known spying hosts. Many people still want to access Facebook and Instagram, though.

yea... that seems the biggest problem for sure... i really hope apple builds in some mechanism for this soon

My copy of Charles on iOS disagrees.

Also, collecting income is and always has been possible without selling/leaking private user data. This is a red herring.

> I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark...

Their kids should be able to help.

>Surely there are open source video chat solutions already? They haven't taken off for one simple reason: video hosting is expensive. It's quite literally one of the most intensive network activities you can partake in, rivaling torrenting.

There are, as you state OSS solutions [0]. But the video hosting is not akin to Torrenting. Most people are fine with 720p quality video as you're not "watching" the participants like a movie. And as you scale up the number of users the required bandwidth for each subsequent user goes down in a linear fashion due to reduced screen real estate. A conference with 8 users, from a video perspective doesn't reasonably take up more bandwidth than that of 2 given the smaller stream. I am on almost constant conference meetings with 4-12 users, many times with video and I have a full packet monitoring solution at home and can tell you it's not remotely as intensive as you've claimed here.

[0] https://jitsi.org/jitsi-meet/

> Most people are fine with 720p quality video as you're not "watching" the participants like a movie.

Most people are fine with 720p movies too.

This whole Zoom revelation reminds me of the Cambridge Analytica scandal. This has been going on for a long time now, and it wasn't until one specific company did it that everyone is now concerned.

If you want to be creeped out, go to https://www.facebook.com/off_facebook_activity/ and find out how many apps have been quietly reporting all your usage activity to Facebook.

I have 100's of websites which managed to identify my Facebook account despite me logging into Facebook only in Incognito for the past 2 years.

Mine shows nothing: "You have no available activity to show at this time."

I have been running Facebook in the special Firefox container pretty much since it was available. I took off the WhatsApp and Instagram apps from my phone months ago. For me, the number of ads (on Instagram) and integration into Facebook made them expendable.

I don't know if Facebook really has no information or they do but are not showing it to me.

I'd like to do the same with Google but the Google container wants to force all interactions with Google into one container. I've got dedicated containers for different Gmail identities - it was very handy to have a Gmail identity while I was president of the kids' soccer club and then turn the account over to someone else.

> I don't want to live in a world where my parents and grandparents are expected to pull up Wireshark to figure out if the app they're using will record their front camera without consent.

It's a "commons" issue. I don't necessarily trust FOSS software because I am going to login to the repo and check the code (though I have once or twice), I trust it because I know thousands of people motiviated by ethics and quality vs. money have peer reviewed the code for things like this.

Similar in concept to herd immunity.

> Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone.

There’s plenty of anger to go around. Get mad all all three: Facebook for making an SDK that tracks you, Zoom for integrating it, and Apple for letting it through unencumbered.

I can't tell if your comment is intentionally funny, but I got a good laugh out of it.

I wasn't trying to; what about it did you find humorous?

Do you know what developer uproar there would be if Apple decided to block all Facebook SDK usage? Surely you know most anger will be targeted at Apple, rather than FB.

>Getting mad at Zoom for using the Facebook SDK is missing the point.

It's really hard to believe this point given that... getting mad seems to have worked.

Doesn't scale. We can't have 1,000,000 front page "App X uses Y SDK" posts. People will stop caring. Nobody's made a post of that flavor in awhile, and Zoom got caught in the crossfire. Honestly, if anything it shields other apps. People have a limited capacity for repeatedly addressing the same thing.

I think it doesn't always have to scale. Zoom is a huge player right now and in great usage across all industries, countries and users.

That's a great point. The 80-20 rule likely applies here. Of all instances of beaconing events, the bulk of those events originate from a small number of popular apps.

Really?!? If it wasn't for this post I wouldn't even know that they exist.

What industry do you work in and what country are you in right now?

Fortune 500 consulting, European Union market.

Webex, Teams, Slack are the only ones that matter.

"Webex, Teams"

Yeah some companies are behind the curve (not blaming you).

Zoom is getting very popular

From security perspective, Companies do not like the fact that Zoom was developed in China and the vast majority of its R&D is still in China. China has different rules on security than many other countries. Particularly surrounding intellectual property. https://www.sec.gov/Archives/edgar/data/1585521/000119312519...

"Top of page 21- In addition, we have a high concentration of research and development personnel in China, which could expose us to market scrutiny regarding the integrity of our solution or data security features. Any security compromise in our industry, whether actual or perceived, could harm our reputation, erode confidence in the effectiveness of our security measures, negatively affect our ability to attract new customers and hosts, cause existing customers to elect not to renew their subscriptions or subject us to third-party lawsuits, regulatory fines or other action or liability, which could harm our business."

I'd guess you work mainly with slower players (the mention of webex surely suggests so). Zoom as been very much on the rise for a year or so, and is riding the coronavirus WFH wave very well. IME quality is better than competitors, but boy do they use dark patterns. Finding the link to the web version in the meeting page becomes harder every day.

In that case, I should probably tell you that it’s a good idea to wash your hands.

Check any news outlet to know why, and you’re likely to also read about zoom in some article.

That's exactly what laws are for.

I pay $20 a month for Zoom and consider it a business product. Collecting analytics via Facebook is unacceptable in this context.

Would any cloud-hosted analytics be acceptable? Is it just Facebook that’s problematic? What if they switched from client-side analytics to server-side so you couldn’t detect it all? Would that be any better? The bottom line is when you use a service, that data is their data to send to whomever they want.

> The bottom line is when you use a service, that data is their data to send to whomever they want.

No.

That's all that really needs to be said about it but I'll add a couple of more lines here so no one thinks I'm lazy or posting a shallow dismissal:

- First, just because someone trusts you it doesn't mean you are free to abuse them. This should go without saying!

- Second: In Europe and I think California as well this is also illegal.

My point is that you've removed one instance of the Facebook SDK from your phone, but you still have 50 others. Plus probably hundreds of other analytics frameworks that you've never even heard of that are just as bad or worse.

A journey begins with a single step. As a community, we suss our and shame the rest into removal. If shame doesn’t work, those in California try using the CCPA.

We’re all stuck inside for a while, this is the perfect time to act. One app and SDK at a time.

I could get behind that but am sure people get tired - both the activists and sheer mass of people who would need to get convinced.

During covid nobody is paying attention and we have the additional problem that they're trying to use cellphone location data to enforce social distancing! Once this is in effect it will be difficult to undo because the next epidemic will be "just around the corner" ...

So if you can't stop ALL of them, you stop NONE of them.

No, you attack the systematic problem and don't become happy by fixing one of them, since it is a hollow victory, and public outrage has limited capacity for repeated posts of "app x is sending to Facebook".

honest question: _how_ do we attack the underlying systematic problem to solve it once and for all?

write a blog post?

take it twitter/HN/reddit?

hold a rally/demonstration outside Apple/Google?

call our MP?

bombard their employees with phone calls or knock on their front door where they live?

write malware?

... really I got nothing that sounds like it would work. In retrospect all of Tim Cook's privacy / security grandstanding and attitude of superiority was just that. There are no good guys in this game.

Legislation?

sure, but since I am unable to actually make legislation I wrote "call your MP" - which is more sobering/realistic if you look at the likely success of this particular effort.

We're outgunned by the lobbying from these companies I think.

Buy a better behaving phone, or admit that you don't mind being spied on as compensation for features.

Why not go both ways ?

In this very thread we started from “I can tell you from experience that everyone does this.”.

Now when a PO will be asked to add facebook in its app (or wants to remove it) there is at least one prominent instance to point to showing that having the SDK is not the right move. And hopefully that “everyone does it” will become “some still do it”.

If of course in the meantime we find a working systematic solution, it’s all for the better.

This is unsustainable. It requires constant vigilance and turns the privacy matter into a cat and mouse game where we are constantly one step behind the worst actors. These systems exist everywhere in the world and they’re fundamentally inefficient. E.g. recycling, or “please bring your own plastic bag”, which relies on goodwill.

Compare to a system where you fix the incentives to automatically align everyone’s interests: e.g. bottle deposits, or a small fee for plastic bags. Now people will want to do the right thing, because it is aligned with their own interests.

The same holds here: fix this one instance with enough outrage, there will be a thousand more. Instead, let’s fix the misaligned incentives between app builders and users, so their invasion of my privacy costs them as much as it does me (e.g. GDPR).

This is how you make efficient markets: align incentives. Fixing everything on a case by case basis only provides temporary relief.

[edit: note that OP never said "don't do it", they just said "it's missing the point". which I think is a fair call. this one fix is good, but it's unsustainable.]

> bottle deposits, or a small fee for plastic bags

You know how these programs started? They started small. A few stores requiring them. Eventually, they become a law.

I guess your point is that fixing this one transgression is the equivalent of one store implementing that rule, and if we fix more of them eventually it’s a law, making it but the first step on the journey to sustainable privacy?

It isn’t. This is recycling one bottle. It doesn’t have any sustainable long lasting effect.

To stretch the metaphor, the equivalent of one store asking for deposits would be e.g. Apple requiring full disclosure of all such tracking SDKs on the App Store page, as suggested by someone else in this thread. That’s sustainable, scalable, and that’s what might eventually even lead to legislation, as you pointed out.

Right. There's no point in locking 6% of your doors. It's security makework theater, like trying to use a treadmill for transportation.

If Apple notices this press, they may very well ban uploads of new apps containing Facebook SDK versions with this telemetry.

If California and the EU get wind of this, they may also give Facebook a gentle nudge.

That'll get Facebook to remove it fairly quickly, or at least stop triggering it in the background without user initiation.

No, raising widespread awareness seems to have worked. Getting mad reduces the chances of someone responding usefully.

Of course passing laws about that is a great solution. This is how society defines what is and what isn’t acceptable behavior for corporations. Are you also typing up rallying paragraphs against laws that dictate how companies have to adhere to food safety? Would your suggestion then be to “get mad at Burger King for not allowing you to perform chemical tests in the restaurant”? “Everyone does it”, like everyone used asbestos and lead pipes in the past?

I agree laws help, but well done laws. Not another cookie consent mess again, please.

You can pretty easily see all the traffic on your own phone. You can even do it on device

https://apps.apple.com/us/app/charles-proxy/id1134218562

Seeing it != blocking it.

If you can see it you can make an informed choice if the tradeoff is worth it.

If you can see it, but can't block it, then you've already lost a part of it before you can make that informed decision.

Of course you can block it, a private DNS with ad blocking is trivial to setup. Knowing about it is far important as you can make informed decisions.

You basically need your own VPN server with Pi-hole installed to control the tracking. It is a very effective way to block this, but not that easy to setup.

If you can use NextDNS, you have something akin to a Pi Hole.

So https://guardianapp.com then?

Does this work with apps that do their own TLS using their own pinned certs? I don't see how it could. Surely that's a lot of high profile apps these days.

If this app works without root, it must be possible to apps on iPhone to add their own certificates to the system, which are then trusted by other applications - that would already be pretty alarming. I think Android still requires certificates to be manually imported by the user. Maybe this app points you to instructions on how to do this, but the description makes it sound very automatic.

No, you’d need to jailbreak or modify the application for that.

You can add an ssl certificate but if they do cert pinning then it breaks. Most don’t do cert pinning.

If you've got a Jailbroken phone, this post explains how to extract the TLS keys (to decrypt the traffic) using a Frida script

https://andydavies.me/blog/2019/12/12/capturing-and-decrypti...

For sure, it can be done, I was just thinking that MITMing yourself on iPhone is not so easy these days as just installing this one app.

If you can set your own DNS on iOS why not just use something like nextDNS.io?

NextDNS is fantastic. I use it to block ads on my iPhones and iPads.

When you say 'everyone' in your second paragraph, really you mean 'all of the Silicon Valley style employers I'm aware of'.

That's a tiny proportion of the user population and doesn't imply agreement or consent to the information the Facebook SDK shares. And even if it it did, it wouldn't automatically mean that it's an acceptable or good behaviour by those apps and Facebook.

Bringing widely-distributed privacy breaches to a wider audience's attention can help those users provide feedback regarding products and then allow them to select vendors who respect their values.

> As long as you're running binary blobs that can make whatever network connections they please, people are going to take your data and send it to places you don't know about.

PWAs could answer this problem, at least to some extent, but Apple historically has been limiting the features to protect the AppStore and the Apple Tax (v. the recent local persistence changes in ITP).

It's better than, say, Google pretending that third-party cookies make the web a safer place (yup, that happened).

(Don't get me wrong, I think ITP and Safari are great)

> Get mad at Apple for not letting you wireshark your own iPhone.

People on HN can, but an average user shouldn't have to care about that. I'm 100% up for stronger legislative measures (both tech and dark UX patterns) and more education in this area. Sounds boring, but without it we'll just keep running in circles.

> Who audits that?

I’d like to see Apple launch their own telemetry/events framework, that users can examine the data from, and then cut off everyone else

Hello fellow iOS developer. I have two apps on the Apple store. I never used any external SDK/libraries, only the built-in Xcode ones. I preferred to spent a bit more time in writing/testing but I would never accept that FB and other scum (privacy standpoint) track children (I wrote the apps for my nephews and nieces and I put them in the Apple store just for them)(I don't advertise them at all and I won't do so here either).

Regarding the issue that started this Zoom-FB dialogue I have commented a dozen (or more) times on the necessity to have a firewalled phone that a user (unfortunately the user needs to have basic knowledge of firewall admin) can decide what to allow and what to block. Your point on who audits is valid (I am a CISA and CISM of many years), and, well, nobody does. Each user will have to do his/her own work/effort to keep their family clear of these scum.

Nice to see someone who gets it.

Apple gives you no way to find what your phone is doing, and no way to prevent it from doing it.

They provide company sponsored "controls" on what apps can do, which is about as useful as a factory alarm on a mid-80's car. Except with a modern twist, where they're the only ones capable of installing an alarm. (and imagine the alarm gives a free pass to apple)

The fact that they're starting in on MacOS and Little Snitch makes me think their platform isn't long for the world.

sigh. I do like arch linux.

Yes, we need laws against this and for the gatekeepers to be the enforcers. I used to think that individual choice would solve these problems, but it won’t. Zoom et al are growing like a weed and we can’t protect all our loved ones from this bullshit with individual action all of the time. There are some problems that require government action; I think the events of this year have demonstrated that clearly. Individually we are weak as water, but collectively we are embarrassingly powerful. Time to organise.

>> I can tell you from experience that everyone does this.

This is not true and even if it was true it is an extremely lame argument. You can justify pretty much everything with this logic.

> Getting mad at Zoom for using the Facebook SDK is missing the point. They and a million others are always going to be doing this. Get mad at Apple for not letting you wireshark your own iPhone.

But you’ve just said everyone does it and we shouldn’t get mad at them - so we don’t need wireshark, because it would simply confirm that everyone does it and we shouldn’t get mad at them - right?

Another problem is these analytics platforms just keep getting worse. There used to be a lot of effort put in to not collecting any personally identifiable info. Hell even google analytics was strict about that. It also took time to integrate them.

Now almost all the packages grab identifiable info by default and some are doing things like making screen recordings. Combine that with a rotating set of product owners like described above and a lot of apps just end up making way too many calls to way too many places.

And I do think Apple could and should be doing something more here. Their developer analytics setup is a good example to lead by as it gives users a global option to opt out. They also are able to reject apps for an icon being offbrand so I’m pretty sure they could figure out something here.

You can easily see all traffic on your device, try Charles proxy.

It doesn’t “sound like” that, it’s literally what they’re admitting to. Let’s not spin the narrative here on HN that Zoom didn’t admit to their faults.

You obviously need be a highly technical user, but it ought to be fairly easy for most people here to run a packet capture on their phone: https://developer.apple.com/documentation/network/recording_...

No, they don't? There are very few companies that record your phone calls/video calls, then transcribe them into text. Then store the data for themselves. This includes any data that we shared in the session. Why can't Zoom just come out and explain why they do this? Seems pretty simple. If you asked me?

Don’t blame the drunk driver, blame the auto manufacturer...

Steve Jobs made Apple about the user. Tim Cook is just leveraging that to make it all about the money.

But there could be a law, Apps have to have an option to write all telemetric data to a text file.

Get mad at Facebook for stuffing analytics into their login button library

Note that the functionality is actually attribution for the app adds platform on Facebook. If you run ads on FB for an app, this ensures installs are tracked, and doesn't show the user the ad if they already have it.

You can listen to the iPhone with wireshark using OWASP zap as a proxy.

yeah same here, on web and mobile this is super common. i just went through this with a PM.

Baffling how this can be the top post...

"Who audits that?" We just did. And if there was a law against that, Zoom would just have been exposed for breaking it. Any sane company will try their best to adhere to laws. Some big players like Google can afford to mess around pay a few billions in fines, but those are the exceptions, not the rule. Eventually, even they can't afford to pay the fines in the long run (Even Google bowed to GDPR or at least its getting bashed with steeper fines until they wake up).

"How do you determine what's legal and what's not?" You pass a law, read the law? This is a self-contradiction. Laws are open for interpretation but the interpretation is quite clear after a supreme court case (for the better or worse).

"We should be pushing for a platform that makes it obvious what the software you're running is up to". Oh the web of trust? Did you ever install Snitch or some other firewall on your system? Its utterly hopeless even if you are knowledgeable. There is simply not way to audit that. Who audits that? Here you CAN ask this question.

I can't for the life of me understand how you can believe that it is better for everyone, including parents and grandparents to audit their phone, instead of having researchers audit phones and report companies who break the law. This is non-nonsensical. You must either be some expert without a connection to the real world, or some elitist who thinks everyone is like him.

> Baffling how this can be the top post

Specifically on this point, I think the HN comment sorting algorithm may take account of how many votes child comments have too, so you may find that it’s the top child comment which has brought this to the top.

Constantly having to be in a war against my own phone's operating system is exhausting. These days I absolutely refuse to buy any brand that makes me jump through hoops just to get root on my own silicon.

I'm really liking Zoom's responses to incidents lately. Both this and the "oops we implemented certain features by leaving a localhost webserver gaping open" fiasco fairly recently got extremely nimble responses from them, and the responses were absolutely the right thing to do. They could have hand-waved the http server away and claimed to have "secured" it, and they could have hand-waved this away as "standard practice", which, let's be frank, it almost certainly is. The fact that they understood the seriousness and swiftly yanked the features in both instances is HUGE. Kudos to them for this.

edit: some people won't want to give them any slack because they committed the offenses in the first place, but I think that's silly. Reward them for trying, because if this is the way they're going to respond to blowing it, they're one of the good guys.

in the end they did the right thing with the local web server, but iirc their first response was "this is a non issue and needed for proper operation".

a definite improvement in this case and so far.

I agree that they started out kinda shitty on the web server thing, but they corrected pretty decisively. The web server was gone within days.

Reply on news.ycombinator.com