3 ms·

@rainforest's reply pretty much covers it. NPAPI was deprecated for security reasons so they thought it was a good idea to bypass that deprecation by installing

@rainforest's reply pretty much covers it. NPAPI was deprecated for security reasons so they thought it was a good idea to bypass that deprecation by installing a local webserver. My other comment on yesterdays thread: https://news.ycombinator.com/item?id=22658173 https://news.ycombinator.com/item?id=22658173

skrebbel 7y ago
How is that the same as malware? I.e. "software intentionally designed to cause damage to a computer, server, client, or computer network", if the Wikipedia definition has authority. That's not at all what Zoom does. You're assuming ill intent where there is none. At the worst, it's incompetence. And they fixed the local http server flaw. I'd much rather we reserve the term "malware" for actual malware and not dilute it to mean "any program made by a programmer who's either not very good at security or doesn't have the exact same opinion about it as me".
- DyslexicAtheist 7y ago
  you're misrepresenting what I said: > they actively bypass the security control on the host-system where it is installed - this is literally what malware does it is not equal to malware. It is what malware does, which is an important distinction. If you're OK with a product disabling the host-system security controls and still happy to trust the product with this taken in consideration then fair enough: use it, defend it, and evangelize it as much as you want. As somebody who has "security" in the job title it is a problem for me. > And they fixed the local http server flaw. it wasn't a flaw or silly design bug, it was a conscious design decision to gain market share which other players felt too risky. please read the NPAPI spec and why it was deprecated. A company doing this has no place in an enterprise network!
  - skrebbel 7y ago
    > > they actively bypass the security control on the host-system where it is installed - this is literally what malware does > it is not equal to malware. It is what malware does, which is an important distinction. That's not an important distinction at all. It's like saying "Ooh George talked to Mary when they were alone in the elevator. That's what rapists do", and then later defending it by saying "well, I did not say that George is a rapist". I agree with the remainder of your comment, fair point. I think your initial comment would've been stronger if you had used the "no place in an enterprise network" argument instead of the malware comparison.
    - khafra 7y ago
      > That's not an important distinction at all. It's like saying "Ooh George talked to Mary when they were alone in the elevator. That's what rapists do", and then later defending it by saying "well, I did not say that George is a rapist". Installing an HTTP server on your client to bypass security control is not talking to Mary in an elevator. It's following Mary home, and making a copy of her house key.
      - deleted 7y ago
        [deleted]
      - skrebbel 7y ago
        My only argument is that you can't first imply that Zoom is malware and then claim that you didn't say Zoom is malware.
- chupasaurus 7y ago
  Spyware (which Zoom is) is also a type of malware.

skrebbel 7y ago

How is that the same as malware? I.e. "software intentionally designed to cause damage to a computer, server, client, or computer network", if the Wikipedia definition has authority. That's not at all what Zoom does. You're assuming ill intent where there is none. At the worst, it's incompetence. And they fixed the local http server flaw. I'd much rather we reserve the term "malware" for actual malware and not dilute it to mean "any program made by a programmer who's either not very good at security or doesn't have the exact same opinion about it as me".

DyslexicAtheist 7y ago
you're misrepresenting what I said: > they actively bypass the security control on the host-system where it is installed - this is literally what malware does it is not equal to malware. It is what malware does, which is an important distinction. If you're OK with a product disabling the host-system security controls and still happy to trust the product with this taken in consideration then fair enough: use it, defend it, and evangelize it as much as you want. As somebody who has "security" in the job title it is a problem for me. > And they fixed the local http server flaw. it wasn't a flaw or silly design bug, it was a conscious design decision to gain market share which other players felt too risky. please read the NPAPI spec and why it was deprecated. A company doing this has no place in an enterprise network!
- skrebbel 7y ago
  > > they actively bypass the security control on the host-system where it is installed - this is literally what malware does > it is not equal to malware. It is what malware does, which is an important distinction. That's not an important distinction at all. It's like saying "Ooh George talked to Mary when they were alone in the elevator. That's what rapists do", and then later defending it by saying "well, I did not say that George is a rapist". I agree with the remainder of your comment, fair point. I think your initial comment would've been stronger if you had used the "no place in an enterprise network" argument instead of the malware comparison.
  - khafra 7y ago
    > That's not an important distinction at all. It's like saying "Ooh George talked to Mary when they were alone in the elevator. That's what rapists do", and then later defending it by saying "well, I did not say that George is a rapist". Installing an HTTP server on your client to bypass security control is not talking to Mary in an elevator. It's following Mary home, and making a copy of her house key.
    - deleted 7y ago
      [deleted]
    - skrebbel 7y ago
      My only argument is that you can't first imply that Zoom is malware and then claim that you didn't say Zoom is malware.
chupasaurus 7y ago
Spyware (which Zoom is) is also a type of malware.