Linux Zoom client proactively reading everything written to X11 clipboard
41 points by encyclopedism 3 hours ago | 8 comments

rmellow 27 minutes ago
Not the first time Zoom abuses privilege.

A few years back, there was something about gaining root on MacOS via Zoom due to shady execution on their end.

They've lost my trust since then, and I'll only run it sandboxed: https://gist.github.com/cielavenir/02f322e322a2a3555dbf2b38f...

I always ask (1) why does an app require installation and (2) why would it require root?

There are valid answers for both, but realistically, all a videoconferencing app should need (apart from audio and video and maybe screen sharing) is to store a config file.

There's no legitimate use for it accessing privileged or private paths.

reply
st_goliath 9 minutes ago
There is no such thing as an "X11 clipboard" that something can be written to. As the poster goes on to allude, X11 has a concept of a "selection" (a primary and a secondary one).

It goes roughly like this: when you select a text in a window, the X client tells the X server "I have the selection now", when you paste in another window, the client behind the other window asks "who has the selection" and requests the selection contents from the other client, the data is then forwarded through the server. The client that claimed ownership has to properly handle some associated requests/events for the whole thing to work.

The key point is, the client that does the "copy" is responsible for the data, the client that wants to "paste" has to talk to it, there is no central "clipboard" style repository like on Windows. If I try to copy/paste and quit the source program before the paste, the data is gone. That's why modern desktop environments usually come with a dedicated daemon that immediately reacts to selection ownership changes, grabs the data for itself and then grabs the selection to emulate the Windows style behavior.

If we play devils advocate, I suppose the Zoom client tries to do just that, not trusting whatever desktop environment you are running. I don't use this software, so I'm going out on a limb here, but I'd guess that the "Zoom Desktop Client" is just another Electron dumpster fire and it's actually Chromium or whatever underneath that does this?

reply
ocd 18 minutes ago
I miss ordinary conference calling being the norm. I like having a desktop IP phone.
reply
jmclnx 24 minutes ago
Par for the course when running a proprietary application. If doing that on Linux, can you imagine what it and others do under Windows ?

As people running Linux should know, you cannot trust proprietary applications.

reply
rvz 3 hours ago
That's bad news. Don't use Zoom.
reply
jrm4 2 hours ago
That's wildly impractical advice for many.

Just use Firefox, or Chromium if you must.

reply
Joel_Mckay 36 minutes ago
Spinning up a conference host for a small office is fairly trivial =3

https://jitsi.org/downloads/

reply
jonathantf2 9 seconds ago
Great, til I have a job interview and they use Zoom
reply