Hacker News Reader

> Zoom is a solid piece of software, and the developers are responsive and seem to care.

I get the exact opposite impression. Not just due to these bugs, but also the hidden webserver thing [1] a while back.

Recurring theme in this (the webserver and the installer issue) seems to be an unhealthy obsession with reducing the number of clicks the user needs to perform. They deliberately chose dubious, hacky solutions over doing things the right way due to this. It makes you wonder what other bad decisions they made in the client or server code.

[1] https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-s...

> Zoom is a solid piece of software, and the developers are responsive and seem to care.

The dodgy things they've been doing suggest otherwise.

* Hijacking package preflight script rather than standard package installation mechanism, so their software is installed before the user clicks Install.

* Installing a hidden web server without user consent.

Claiming they have end to end encryption when they don't.

That's more about management decisions and unethical developers. It still could be a solid software despite those issues.

Does it matter which part of Zoom is causing the issue? It ends up making it shady either way.

> This is a knee-jerk reaction.

When you make weapons technology (as SpaceX does; rockets are weapons technology) and are involved in launching military satellites (as SpaceX is), you kinda have to take security issues seriously.

> This is a knee-jerk reaction.

Large part of, if not entire, Zoom engineering is based in China, so just based on that singular fact IMHO this is not at all a knee-jerk reaction.

Add to that numerous security found in Zoom just over the last few days, and I'm surprised why more companies are not doing the same.

exactly, plus when you're spaceX or a similar tech company it's much better to be safe than sorry. you don't always have the luxury to assume good intentions.

Webex also has a large engineering team in China too.

The senior people are all in the US though.

Decisions like this have less to do with "what are you doing now" and "what was your intention", and more to do with "is there a pattern" which is an externally surfaced signal that something deeper is going on with their engineering organization, long term business plans etc.

Zoom has a pattern of abusing users' trust. Ok, maybe its not intentional, but increasingly, that doesn't matter in security discussions. The fact that it was unintentional is a concern itself. Maybe they lack discipline, or leadership, or something; I'm not asserting to know. But, its no longer good enough to simply say "we're sorry, it was an accident".

Companies that are under ITAR take security indeed seriously- this is not your average ad-selling business.

From the article it seems like Elon is mostly worried about meeting IDs leaking and letting any random connect:

> The FBI’s Boston office on Monday issued a warning about Zoom, telling users not to make meetings on the site public or share links widely after it received two reports of unidentified individuals invading school sessions, a phenomenon known as “zoombombing.”

> I'm disappointed to see it getting dumped on during the past few days.

They have what is commonly referred to as form.

Consider the past year's highest voted stories whose title includes the word 'zoom'

https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=fal...

This is certainly not a 'knee-jerk reaction' to the use of the Facebook SDK, but presumably extrapolates from the history of false uninstallation, insecurity by obscurity, false advertising, etc.

Each of those things has been, as you intimate, patched or resolved -- but does that give you increasing or decreasing confidence in their product and priorities?

> The supposed root exploit found in Zoom also requires physical, logged-in access to the machine, at which point a Zoom exploit is the least of your problems

No, it does not; 9to5Mac is just playing a game of telephone from the original blog post and the actual issue only requires code execution on the machine.