7 ms·

i was about to write the same comment. id bet the percentage of HN readers running 100% signed code is damn close to 0. the zoom witchhunt is really something.

i was about to write the same comment. id bet the percentage of HN readers running 100% signed code is damn close to 0. the zoom witchhunt is really something. zoom may or may not be a witch (im no China apologist, i yell at all my friends for using tiktok), but if we get the answer right it will be based on luck and emotion, not logic and reason.

Angostura 7y ago
I'd bet the number of Mac users running 100% signed code is well over 50%
- virgilp 7y ago
  I bet it's close to 0%, and I think I can prove it too. How much do you want to bet?
  - cdolan 7y ago
    I’m genuinely curious how you could prove anything that is applicable to all Mac users (lets say OS 10.5.x through the current version). Is there an unsigned app/package included with all Mac OS X installs?
    - virgilp 7y ago
      Did you even have signed apps (typically) installed in Leopard? Anyway, it depends on the standard of proof. But for the parent comment, it's fairly easy to get most reasonable people to agree that it's false. As a reminder, the claim is about: > the number of Mac users running 100% signed code You just have to ask yourself: - what percent of Mac users run Javascript code - what percent of Javascript code is signed.
      - Twisell 7y ago
        Obviously OP meant outside of sandboxed environment. There might be exploit out there that exit the sandbox, but they are unintended. But here zoom is intentionaly widening an exploit by being reckless. So thanks to zoom we might now expect even more drastic sandboxing in next MacOS release.
        virgilp 7y ago
        I disagree, not only is it not obvious - it's fairly obvious that he didn't mean that. > the number of Mac users running 100% signed code is well over 50% Would you say he meant "number of users running exclusively sandboxed code"? Or do you claim he means "number of users running 100% signed code outside the sandbox"? The only claim that would even make sense is "more than 50% of Mac users run exclusively sandboxed code". And it can't mean "app sandbox", but any kind of sandbox? Like, do java programs qualify? Is the JVM malware? If you install a signed app that requires the JRE, do you also install something that could run unsigned code?
rootusrootus 7y ago
> the zoom witchhunt is really something I'm beginning to think the same thing. Someone seems to be orchestrating a full out attack on Zoom. I'd say it's working.
KaoruAoiShiho 7y ago
Yeah something like 80% of my code is unsigned since I almost never pay for store apps.
jdm2212 7y ago
> zoom may or may not be a witch (im no China apologist Zoom is an American company, headquartered in the US, employing mostly Americans, subject to US law, etc. Its CEO is an immigrant, but that's true of half the American tech companies out there, including Google and Microsoft. EDIT: I'm white, but my wife is Asian-American and has told me more than once how white people often treat Asian-Americans as if they're not real Americans. I'd never witnessed that myself, but I guess the above comment is the kind of sentiment she's talking about. Zoom may or may not be a scummy company, but its founder's birthplace is immaterial. He's a US citizen, and deserves the same treatment we give to maybe-scummy white American CEOs like Mark Zuckerberg.
- president 7y ago
  > employing mostly Americans "“Our product development team is largely based in China, where personnel costs are less expensive than in many other jurisdictions,” Zoom wrote in a regulatory filing." Source: https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead-of-ipo-engineers-in-china.html https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...
  - jdm2212 7y ago
    The concerns about TikTok are that it's potentially Chinese government spyware because TikTok is owned by a mainland Chinese company which has legal obligations to the Chinese government. Zoom is a US company that is not answerable to the Chinese government. Like many companies, Zoom has chosen to outsource some of its operations, and those overseas offices create various infosec risks. And given that Zoom infosec seems to be a total clown show, those infosec risks are probably more serious at Zoom. But that would be equally true of any other American company that is really lax about security and too cheap to employ American developers.
    - president 7y ago
      > Zoom is a US company that is not answerable to the Chinese government. If that was true, then events like the Huawei USA "Tappy" [1] incident wouldn't have occurred. In any case, I'm not trying to take a stance here but merely wanted to correct your statement that they had more engineers in the US than in China. https://www.npr.org/2019/01/29/689663720/a-robot-named-tappy-huawei-conspired-to-steal-t-mobile-s-trade-secrets-says-doj https://www.npr.org/2019/01/29/689663720/a-robot-named-tappy...

Angostura 7y ago

I'd bet the number of Mac users running 100% signed code is well over 50%

virgilp 7y ago
I bet it's close to 0%, and I think I can prove it too. How much do you want to bet?
- cdolan 7y ago
  I’m genuinely curious how you could prove anything that is applicable to all Mac users (lets say OS 10.5.x through the current version). Is there an unsigned app/package included with all Mac OS X installs?
  - virgilp 7y ago
    Did you even have signed apps (typically) installed in Leopard? Anyway, it depends on the standard of proof. But for the parent comment, it's fairly easy to get most reasonable people to agree that it's false. As a reminder, the claim is about: > the number of Mac users running 100% signed code You just have to ask yourself: - what percent of Mac users run Javascript code - what percent of Javascript code is signed.
    - Twisell 7y ago
      Obviously OP meant outside of sandboxed environment. There might be exploit out there that exit the sandbox, but they are unintended. But here zoom is intentionaly widening an exploit by being reckless. So thanks to zoom we might now expect even more drastic sandboxing in next MacOS release.
      - virgilp 7y ago
        I disagree, not only is it not obvious - it's fairly obvious that he didn't mean that. > the number of Mac users running 100% signed code is well over 50% Would you say he meant "number of users running exclusively sandboxed code"? Or do you claim he means "number of users running 100% signed code outside the sandbox"? The only claim that would even make sense is "more than 50% of Mac users run exclusively sandboxed code". And it can't mean "app sandbox", but any kind of sandbox? Like, do java programs qualify? Is the JVM malware? If you install a signed app that requires the JRE, do you also install something that could run unsigned code?

rootusrootus 7y ago

> the zoom witchhunt is really something I'm beginning to think the same thing. Someone seems to be orchestrating a full out attack on Zoom. I'd say it's working.

KaoruAoiShiho 7y ago

Yeah something like 80% of my code is unsigned since I almost never pay for store apps.

jdm2212 7y ago

> zoom may or may not be a witch (im no China apologist Zoom is an American company, headquartered in the US, employing mostly Americans, subject to US law, etc. Its CEO is an immigrant, but that's true of half the American tech companies out there, including Google and Microsoft. EDIT: I'm white, but my wife is Asian-American and has told me more than once how white people often treat Asian-Americans as if they're not real Americans. I'd never witnessed that myself, but I guess the above comment is the kind of sentiment she's talking about. Zoom may or may not be a scummy company, but its founder's birthplace is immaterial. He's a US citizen, and deserves the same treatment we give to maybe-scummy white American CEOs like Mark Zuckerberg.

president 7y ago
> employing mostly Americans "“Our product development team is largely based in China, where personnel costs are less expensive than in many other jurisdictions,” Zoom wrote in a regulatory filing." Source: https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead-of-ipo-engineers-in-china.html https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...
- jdm2212 7y ago
  The concerns about TikTok are that it's potentially Chinese government spyware because TikTok is owned by a mainland Chinese company which has legal obligations to the Chinese government. Zoom is a US company that is not answerable to the Chinese government. Like many companies, Zoom has chosen to outsource some of its operations, and those overseas offices create various infosec risks. And given that Zoom infosec seems to be a total clown show, those infosec risks are probably more serious at Zoom. But that would be equally true of any other American company that is really lax about security and too cheap to employ American developers.
  - president 7y ago
    > Zoom is a US company that is not answerable to the Chinese government. If that was true, then events like the Huawei USA "Tappy" [1] incident wouldn't have occurred. In any case, I'm not trying to take a stance here but merely wanted to correct your statement that they had more engineers in the US than in China. https://www.npr.org/2019/01/29/689663720/a-robot-named-tappy-huawei-conspired-to-steal-t-mobile-s-trade-secrets-says-doj https://www.npr.org/2019/01/29/689663720/a-robot-named-tappy...