Their website headers also whitelist a lot of domains including quite a handful that are known malware distributors. See for yourself: curl -I https://zoom.us
These are a blanket permissions for third party ad and affiliate (user tracking) scripts, so much for "targeted at organizations with IT departments" and "we do not sell you data"
This list makes me scratch my head... when, ever, would ".google.com" be filtered the same way as ".50million.club" or even "googleads.g.doubleclicj.net"?
I understand the header causes logged reports, no actual policy enforcement, but still... I don't have a good read on their underlying concern here.
If I understood it correctly it tells the browser iranok to run scripts from all these origins. No idea why there are so many malware associated domains here. Maybe zoom’s ceo could enlighten us. Probably because of the virus and unexpected growth I’m sure.
The domains are likely in the whitelist as their report-uri was getting spammed with reports from users that have adware/malware extensions in their browser.
These extensions inject their own scripts into the page which will then fail based on the CSP and send a report to the server. In an ideal world you would just 'ignore' these reports server-side instead of whitelisting the domains.
