Hacker News Reader

Comment by cookie_monsta | Hacker News Reader

Point taken, but none of the issues raised over the last few days had anything to do with scaling problems. The humblebrag of "we were just a little company and then we got hugged to death" doesn't sit right when a lot of the issues fall into the same category: prioritising ease of use and onboarding over security.

As for "Thousands of enterprises around the world have done exhaustive security reviews of our user, network, and data center layers and confidently selected Zoom for complete deployment."... well it can't have been that exhaustive if a couple of weeks in the sunlight have generated a shopping list full of concerns.

Kudos for half-playing by the 3F rule, though - probably their smartest move yet

View on HN

He says:

> These new, mostly consumer use cases have helped us uncover unforeseen issues with our platform. Dedicated journalists and security researchers have also helped to identify pre-existing ones.

I don't think he is saying that these issues have to do with scaling problems, but rather that the increased usage + new types of usages led to increased scrutiny and uncovered new issues. Which is correct in a way.

Obviously, they were told several issues in the past too, but then those issues were not costing them money. Now they are, so they are trying to fix them.

A year ago they architected their system to not uninstall when you asked it to uninstall, and instead it left a running daemon that would re-install as soon as it saw a relevant URL.

This isn't a scaling, usage, or whoops issue. This was intentional.

Maybe. I've got enough uninstaller logic wrong in my day to believe it possible that a failure to switch off all your daemons and delete them is just sloppy software engineering on a piece of the system that isn't considered critical path by product managers.

After all, users never want to uninstall our software, right? That implies they don't love our product. And of course they love our product. ;)

It's not that uninstalling isn't an important feature. It's just that at crunch time, project managers will pull people off polishing the uninstaller to put them on that virtual green-screen feature 10 out of 10 times.

This was clearly not an accident, but a dark pattern.

There are way too many complex dark patterns which have been exposed to excuse them as oopsies. This is a company where product managers overruled developers into creating security-breaking implementations for the sake of "usability".

You just described exactly what I described, only attaching a malicious connotation to it.

It doesn't have to be malicious; the fact is that the market simply favors usability. Optimizing for the things users care about over the things they don't is the first PM guideline. This has been demonstrated over and over and over again; have users first, then worry about security and privacy.

> You just described exactly what I described

I don't think parent did.

What you originally described (or proposed) what that it may be a simple case of accidentally overlooking a bit of tidying up during uninstall.

What I described - the problem that came to light March and then June last year - is that Zoom installed a web server on your Mac whose sole purpose was to silently re-install Zoom if you a) uninstalled zoom, and b) later clicked on a zoom link.

There is nothing about it that could be attributed to 'getting uninstaller logic wrong'.

Refer: https://news.ycombinator.com/item?id=20407233

This is not correct. I have some sympathy for them, maybe this was what was needed to grow with a dev center in China. They might have been pressured by government authorities.

The statement admits that they fell short of the privacy and security goals but go on explaining how it's not their fault. It makes it look like either the issues are non-issues, or they're someone else's issues, or "we'll do these generic things that don't address in any way how those issues came to be". Which is a big thing to mention if you care about transparency and earning back the trust.

Some of the biggest issues came to be due to deception and this message does not address that point. They were intentional decisions with effort put into obscuring them. One of the most egregious being the creative use of the "end to end encrypted" moniker. That was deliberately deceptive and I don't see this cookie cutter response addressing any of that.

More engineering resources and engineering fixes don't fix deception, that starts at the top. And this puts the whole message into question.

Reply on news.ycombinator.com