Hacker News Reader

Comment by crazygringo | Hacker News Reader

Key section:

> Over the next 90 days, we are committed to... Enacting a feature freeze, effectively immediately, and shifting all our engineering resources to focus on our biggest trust, safety, and privacy issues.

I see a lot of comments here claiming that this blog post is bland corporate apologia, doesn't take responsibility, doesn't change anything.

But this seems like a pretty legit turnaround. Overall, they seem to be addressing pretty much everything that's been brought up. They removed the Facebook SDK, they removed attention tracking, they've clarified their encryption policies in detail.

One commenter here is asking for more, for punishment, another demands their security team be fired. And I mean, if someone wants to try to sue Zoom for misusing the term E2EE then go for it, but obviously Zoom can't "punish itself" in a blog post, and pinning it on a few bad engineers feels like a scapegoat.

This seems to be positive steps, folks. Genuinely not sure what more you could be asking for from a regular for-profit business.

View on HN

> another demands their security team be fired.

This drives me nuts. Disclosure: I'm currently working in a security role. My company is great, and if someone on my team says "we shouldn't do this", the reaction is to meet and decide how to replace an idea with something that serves the business request and our (and our users') security needs. I love it.

But I also know I'm being spoiled here. More common in my experience is:

Software engineer: We need to do a thing.

Security team: No! We can't do thing at all. It would ruin us.

Engineer's manager: We've already started and our CEO promised it to a customer. Do your job and figure out how to secure it.

Just saying, cut that group a little slack until we know that someone actually didn't do their jobs.

To be fair sometimes the security team is wrong or being over protective. There has to be a balance because it’s too easy to think of “what if” , Mission Impossible style, scenarios that have no hearing on the real world.

The more I'm online the less I feel like there's ever such a thing as over protective.

There's such a thing. You can get asymptotically close to "perfect security", but it really is a risk evaluation game. Is it worth it to spend $20,000 to run a pen test and make sure we're not grossly vulnerable to attack? Sure! Is it worth spending $50B to develop our own hardened OS, hosted inside our data bunker with airgapped servers running on custom CPUs? Probably not. The challenge becomes how to identify when you're as good as you reasonably can be given the threats you realistically face on a budget that doesn't resemble a small country's GDP.

Of course there's always a scenario that could be malapropos; yet most of the time we're not comparing $20k to a figure that has a larger GDP than many countries. I always get a kick out of people on the internet who take what I say and blow it way out of proportion to try to win an argument against me that I never made in the first place.

Anyway, I agree with your last sentence; at what point is something "good enough". Lately I feel like the "good enough" in a significant amount of corporations isn't acceptable. I'm in healthcare and the absolute lack of security in my day to day is absolutely amazing.

I think you're reading stuff into my reply that I didn't intend. I didn't want to argue with you. I read your post as though you were asking a question, and I answered it.

I agree with you on that last bit. While it's important to have your compliance ducks in a row, a lot of shops seem to feel like "we've checked all the audit checkboxes so we're secure now!" No. All that stuff is nice, but having a documented process for deciding who gets root on your database servers is not the same as actually securing your database servers.

You're absolutely right. I have two main job functions:

1. Instead of saying "no", saying "not that way, but let's figure this out together".

2. Evaluating risk and modeling threats: "this is who we're protecting ourselves from, and here's what happens if we fail." If a bored teenager on their couch hacked our website, it would be embarrassing because someone without a lot of resources would be able to make changes to our display system, even if no real harm was done. If North Korea hacked our user database, it would suck and be bad for our users, but in practice not too many people are going to get angry at us for being attacked by a hostile nation's government as long as we were doing the right things.

(Note: that's grossly simplified, and it's not like we're "heh we don't protect against nation states".)

> One commenter here is asking for more, for punishment, another demands their security team be fired. And I mean, if someone wants to try to sue Zoom for misusing the term E2EE then go for it, but obviously Zoom can't "punish itself" in a blog post, and pinning it on a few bad engineers feels like a scapegoat.

A portion of the development community loves to talk about blameless post-mortems and a blame-free culture until a tech company like Zoom does something they don't like.

I think it's generally a poor assumption to assume that any two internet "crowds" are the same people. Some commenters care about X and some about Y and we can almost never tell what the overlap between those groups is. The hivemind is not as uniform as that.

Well said, and it applies beyond just "internet" crowds. Some people think whole nationalities work as uniform hiveminds.

If the citizens of the internet didn't vehemently demand blood for any misstep, would it still be the Internet?

While I agree with you, I can imagine people who prefer being blameless towards accidental mistakes (engineer ssh'd into a wrong host and dropped prod DB instead of testing) but demand proper punishment of "misfeatures" created on purpose (like spying on users).

> until a tech company like Zoom does something they don't like.

Consistently does something they don't like. Most people forgive single instances, but they don't forgive patterns as much. Especially when the patterns look like they are on purpose.

Well, speaking solely for myself, I am more willing to forgive genuine bugs or even targeted attacks (supposing the company being attacked was doing the right things e.g. no weakly hashed passwords, keeping as little PIA as they can get away with, proper isolation) over misfeatures that hint at deep company culture problems ("Hmmm, how can we profit from our users' data, even though they're already paying us?")

I agree. I'm just as skeptical as the next person about PR corporate-speak, but there's a clear action plan here and addressing of concerns. At least give them a chance to make good on their claims right?

We've become such a cynical culture, once pitchforks are brandished they appear to be unsheathable, rather they grow sharper and more wild as the chorus of internet echos grow. While there is value in discouraging certain behaviors (and thus "make an example"), and encouraging new ones (some level of noise was needed to warrant a response at all), surely there must be a path to redemption, an acknowledgement of misaligned incentives in lieu of the demonization of individuals. There are too many true enemies in the world (most of them not processes not people) to harbor such disgruntlement against a platform which is by at least basic measures doing good (providing a service that is obviously loved and used by many and jobs and economic well-being to those who make and support it).

I personally have been wary of Zoom since the first reports of their apps doing shady things (and the forcefulness with which they attempt to make you use it) and don't find it provides any value over a multitude of other services. But this wariness warrants a mere "meh, I'll go elsewhere," not a crucifixion. Yet as the frothiness grows from this current story (and it's really not much of a story) it becomes more difficult to see just what sort of blood sacrifice will satiate the mob.

I think that's unfortunately a climate that arose as a reaction to the sustained appalling behavior by FAANG and wannabe-FAANG cowboys.

When you have a handful of tech companies who systematically, unashamedly and deliberately abuse people's trust and privacy, it ruins the landscape for everyone. As it stands today, our trust has been betrayed so many times that a default assumption that the other actor is malicious and will do the wrong thing is almost always correct.

It's a shame, but this seems to be the case for every industry that is consumed by greed, and almost as a rule, every successful industry will eventually be consumed by greed. It's a local minimum that our society in it's current form cannot seem to avoid.

Well, yes, but now you're saying our trust is limited because other companies do bad.

But we have a pretty good reason, beyond that, to not trust Zoom - THEY clearly never gave a shit about security, given in a few weeks of people taking a slightly deeper look we've had pretty much every possible leak and bug and problem you can imagine crop up.

How long did it take Microsoft to go from "no-shits-are-given-security" to "security-is-core"? 2 decades, something like that?

So yeah, sure, 90 days, that's... well, maybe the beginnings of a start.

It is not possible to extrapolate with certainty the quality of code from the bugs that remain in it when released.

“There’s a misspelling in the HTTP headers spec, so obviously this was written by amateurs.”

“Browser X has an RCE, so obviously they don’t care about security.”

These are obviously faulty logic when stated about other scenarios, and apply here as well.

Has Zoom been found to have the same specific technical issue reoccurring over multiple releases, to the tune of “buffer overflow” or similar? If so, then that’s a trend to throw up warning flags about.

A series of bugs that share no commonality other than being bugs is, perhaps, not so much.

Your entire reply feels overly cynical. No, nobody likes it when companies invade your privacy, a la F & G.

However, saying "it took another megacorp twenty years to fix their privacy problems, so we shouldn't trust $relativelysmallcompany for the next two decades" is not fair to $relativelysmallcompany and doesn't even consider the cultural change it probably took to get $megacorp to actually care about security and user privacy.

Personally, I don't really like Zoom. I use it, and it works okay, but there are a lot of little nitpicks I would like to see addressed- for instance, it'd be really nice to be able to adjust individual member's volume levels or be able to mute them outright as a participant instead of listening to a compressor that needs a new bearing in the background for an entire meeting because they're not using push-to-talk and the host just downloaded the client yesterday. I'm also more than willing to give a company time to fix underlying architecture problems and not demand fixes in the meantime.

I would want to be given the benefit of time to fix problems, wouldn't you?

Well so again I think these are misattributions here. You're using language like "trust," "unashamedly," "malicious," in circumstances where "behavior," "incentives," and "value" are more fitting. This framing is why the pitchforks get yielded with such ferocity, demonization/victimization in situations that require more careful scrutiny and nuance.

> It's a local minimum that our society in it's current form cannot seem to avoid.

It can't avoid it because it is the result of incentives, not specific players. This is why it's so ineffective to brandish hostility towards individuals or even companies: others, up to and including yourself, would do the same things if put in the same positions, because that is what would be best for you (and there are plenty of rationalizations you can come up with to show why it's net good).

To eradicate this kind of thing we cannot be relegated to impotent rage with mob-issued pitchforks at industries or companies or the individuals who operate them, or play the victim card and blame the industry for "betraying our trust." The "why" of this is not an "industry consumed with greed," it is a fundamental result of technological breakthroughs in an economic environment such as ours. When you have bad incentives you will continually get bad actors, and playing whack-a-mole with them will be a fruitless exercise. We have to recognize the systems as a society, not the players, if we are to have any hope of true reformation.

I agree that this is a systemic issue and as long as the system is the same, the outcome is unlikely to change, hence why I wrote "It's a local minimum that our society in it's current form cannot seem to avoid".

So a change in the system is required to fix the root cause, but I think some amount of pitchfork waving and torch igniting is not out of the order. The excuse of "everyone would do it with these incentives" is not an excuse for this behavior. And I say that fully admitting that I'm part of the system (although a different industry), and yes of course I'd do (and am doing) the same given the choice.

Perhaps the pitchforks show the individual the error of their way, and the society will change once enough individuals decide to make the change?

Maybe, I do agree it's warranted to call out bad behavior and impose some penalty on said behavior to discourage it. After all, this "feedback" has elicited a response here at least. But I worry that:

A) It misses the bigger picture and thus doesn't address the underlying cause, thus it will continue to happen over and over.

and

B) It feeds an outrage culture that permeates far too much of our online conversation that requires more nuance and careful dissection, which paired w/ the first leads to division and us vs them mentalities when more than ever we mentalities are needed.

Perhaps I'm overly sensitive to that second one because I'm more focused on systems and because outrage culture, which itself is bourn of other misaligned incentives, is a large problem underlying other issues that I've tended to notice more in my circumstantial isolation. So in a sense I'm being hypocritical when I plead for a more measured and forgiving response as I'm addressing individuals not the systems that caused them to react in this way. Mostly I'm just thinking out loud, as are we all (we're thinking at each other rather than with each other, another issue, related to outrage culture).

Anyway, as I'm in danger of severely incoherent rambling here I'll circle back to say I cautiously agree with you that some measure of pitchfork waving is warranted. But when the CEO makes a response like this, at least on its face an earnest effort to right past wrongs, can't we at least give them a chance to do so? Otherwise the pitchforks lose their meaning as it begins to look like they were out just to be out, and we're more concerned with persecution than actual redemption or resolution.

> At least give them a chance to make good on their claims right?

I’d be much more willing to cut them some slack if this was their first offense, or if their previous mea culpas had showed evidence of change. Today, it feels like “This time for sure!”

Or, maybe more accurately, "This time we actually have to because there are consequences to not doing so."

Two things: Zoom has established a clear pattern of malfeasance which can no longer be forgiven by writing it off as incompetence. Second, the stability of the world now depends on tools like Zoom, and their bush-league petty-criminal nonsense cannot be tolerated in a time of planetary emergency. Blood sacrifice is completely warranted here.

While I agree that we can't continually forgive them for intentional behavior, I think you need to, at the very least, acknowledge that what they were trying to do, albeit poorly, was to limit the interaction needed from the end-user to make their product seamless when someone clicks a link. To go from there to being a tool of worldwide necessity and critique in a matter of weeks is unfair, in my opinion. It wasn't incompetence so much as it was something that worked and wasn't a big issue when they were just a small link in a chain. It's important now but that doesn't mean that the response is blood sacrifice. That's just as bad as the knee-jerk cancel culture that's everywhere.

Did they actually establish a clear pattern of malfeasance? To me, a DevOps dude, it seems like they simply did not pay attention to security and privacy and focused on making features as easy to use as possible. Many security experts will tell you that security is all about trade offs between convenience and privacy. Zoom went to market basically only focused on convenience and now that the whole world is using the platform they have all eyes on their products.

It doesn't seem like anything they did warrants "Blood Sacrifice", and it doesn't seem like anything they did was criminal negligence. Security incompetence? Yes certainly, but lets be real, 99% of companies would fail under the same security scrutiny if the company suddenly had 190 million more users using their same product over night. Aren't you at least glad their CEO cares enough to address these issues? Its not like Facebook drastically addressed their users privacy issues, even with intense scrutiny over the last few years. The situation with Zoom could be much much worse. They definitely have some more work to do, and we should keep holding them accountable, but since I am forced to use Zoom for work, I'm glad they're even pretending to take these issues seriously.

People need to put the pitchforks away.

I don't think Zoom has done anything malicious. I think they just built their software quickly and just made it work.

Now that it's under a lot of scrutiny they're paying a bit of PR price. But they'd probably do it all over again since they are now seeing hundreds of millions of users.

You make it sound like a startup that build a piece of software quickly and forgot a few things.

There are two issues with that argument. First, they put in EXTRA effort to break the security of their users. The feature of 'upon de-installation, install a daemon on the system that silently re-installs the app whenever a zoom link is clicked' is MORE work than not doing that, for example. Second, they are 8 years old, have 2500 employees and a revenue of over 600 million. I work at a 30 ppl startup and I would not at all be surprised of we invested more hours in security in 2019 than Zoom did...

I'm running Zoom in a virtual machine, & while I'll continue to do so, this news will pause me from recommending others (who are unwilling to sandbox applications) to not use Zoom

Still, would like their WebRTC UI improved. The use case I'm in requires gallery view & the web ui lacks that, so I ended up having webrtc streaming me out while using Zoom in Windows Sandbox to view (Sandbox isn't able to use my webcam). "easy to use" wouldn't describe my experience

>> One commenter here is asking for more, for punishment, another demands their security team be fired.

Internet jerk trolls who feel they aren’t jerk trolls because they feel they occupy some moral high ground.

“I’m not a jerk troll cause they’re bad bad!”

>This seems to be positive steps, folks. Genuinely not sure what more you could be asking for from a regular for-profit business

I don't consider a public company worth umpteen billion dollars to be a regular for-profit business. They had the resources to address these issues before the public attacked them for it, and chose not to. With the same team in charge, why would I expect them to be proactive on similar issues in the future?

Did they remove the FB SDK completely, or just from the iOS app? The last post I saw from them was just the iOS app, and nearly bragged about it still being part of the webApp.

FTA: "On March 27th, we took action to remove the Facebook SDK in our iOS client and have reconfigured it to prevent it from collecting unnecessary device information from our users."

Any blog posts that claims enterprises did any kind of meaningful security evaluation is a joke. They say almost nothing about fixing their existing shenanigans nor their past failures in that posting.

> One commenter here is asking for more, for punishment, another demands their security team be fired

Sometimes engineers are clueless, but it is unlikely that all of them are clueless. It's unlikely, unless the company is small, that there's a single engineer that's responsible for something.

However, a single person can be clueless and do incredible damage. Such persons are often called 'managers'.

They are making a lot of money at the cost of putting their users at risk - a big fine seems in order.

On what legal grounds?

GDPR, CCPA, etc. Things are changing in the industry and law makers are slowly catching up to protect their citizens.

I can't help but wonder if a Zoom that had, hypothetically, needed to be ultra-paranoid about GDPR or CCPA compliance would have a product on the market capable of wide adoption at the time the world suddenly needs a videoconferencing tool. Everything has tradeoffs.

Zoom has been around for a while, it didn't just spring up when COVID-19 hit.

Which part of the GDPR do you think would have significantly delayed development?

Which part do we think would be grounds for a lawsuit?

You're avoiding my question.

I really don't agree with your argument that caring about user security and privacy would have a substantial effect on development time, certainly not in respect of GDPR.

If that's not true, we should be able to see an alternative to Zoom on the marketplace right now with as wide adoption as Zoom.

The fact we don't indicates there may be some reason security and privacy take a back-seat to usability and market adoption (and, in fact, it appears we've seen that pattern over and over again). "Engineering for security and privacy slows down product-to-market" is, admittedly, but one hypothesis.

Erm... there are plenty of video conferencing alternatives - video conferencing isn't something new that started with coronavirus.

There are, but I'm referring to one that has the penetration, adoption, and feature-set of Zoom that also has tight security and privacy guarantees.

I can't name one.

Reply on news.ycombinator.com