4 ms·

No affiliation with Zoom, but wow - the unrelenting torrent of negative coverage on HN over the last few days has been remarkable. It seems there's at least two

No affiliation with Zoom, but wow - the unrelenting torrent of negative coverage on HN over the last few days has been remarkable. It seems there's at least two or three negative articles on the front page at all times.

asveikau 7y ago
There was plenty of criticism before. Remember they were the company that ran an unauthenticated web server bound to localhost so that any website could make requests to it and get the video stream. And they made it so that an uninstall wouldn't remove that. That was July. https://www.schneier.com/blog/archives/2019/07/zoom_vulnerabil.html https://www.schneier.com/blog/archives/2019/07/zoom_vulnerab...
- mkaymalright 7y ago
  Excuse me, what the f? Link? edit: Thanks
- jscholes 7y ago
  > unauthenticated web server bound to localhost so that any website could make requests to it and get the video stream I read the linked article. At no point did it (or as far as I can recall any of the coverage at the time) say that the video stream data could be accessed via the local web server. The problem was already bad; no need to make spurious claims to make it worse.
  - asveikau 7y ago
    Ok, maybe that was my slight misreading of the situation. It definitely involved use of the webcam without user consent, however. And an attacker could make you join a meeting that they control, effectively being able to watch and hear you.
    - jscholes 7y ago
      Oh absolutely. I'm not trying to downplay the serious nature of the vulnerability, particularly because it also lead to the possibility of remote code execution. Just want to keep the record straight that at no point did this vulnerability allow people to actively spy on your legitimate meetings.
- fragmede 7y ago
  Zoom IPOd in mid-April 2019. In terms of "start up that made it" or "growing pains", this is what happens when you don't hire a seasoned PR team (and even then). No one was looking all that hard at Zoom's technical practices because no one technical cared that much. Now that the UK Prime Minister is tweeting screenshots which include the zoom meeting ID, it's suddenly become a lot more interesting to lots of people, some of them less scrutable than others. Zoom's older competitors; Microsoft (Skype), Google (Meet), WebEx, etc have undergone similar scrutiny with the similar results - bad press followed by engineering fix.
  - asveikau 7y ago
    It actually sounds more like technical hiring and engineering culture was not good, rather than just PR. I know we all make mistakes, bugs happen, etc. However, if you can't reason through why it's not safe to bind an HTTP server to localhost and consider clients trusted on a laptop that might also run a web browser ... This and other prominent bugs suggests that among other things, security was not a part of the culture or mindset of the rank and file. I don't think you can use "it's a startup, bro" as an excuse for that.
Minor49er 7y ago
I've noticed this too. It's also on other news sites like Slashdot. It comes off like a smear campaign
- dgritsko 7y ago
  I don't think so, the criticism seems well-deserved. It just seems like a natural effect of being thrust into mainstream consciousness due to more people using it while working from home.
  - plussed_reader 7y ago
    The edge cases get a lot more attention when the sample size is increased.
dmitriid 7y ago
Because many more people have started using it and are running into a multitude of issues... with everything. It doesn't help that Zoom has a history of bad practices. Just last year Apple had to issue a silent security updates to macOS to patch Zoom's zero day vulnerabilities Zoom denied existed.
MPSimmons 7y ago
That's just because their approach to building secure software for the masses is garbage. This software smells like it started as an internal tool for a company that escaped.
- bentcorner 7y ago
  It certainly has a weird janky feel for how it integrates with the system. My wife sent me a link to join a meeting for testing. Normally when you have a link and want to have a desktop app use it there's some protocol handler that's registered with the app. Nope - you click the link, it downloads what appears to be an on-the-fly generated exe that talks to desktop zoom. I get the "remove all friction" sentiment but it feels so off compared to any other web/desktop stack of technology.
BurningFrog 7y ago
I'm not at all saying this is one, but this is what an organized campaign looks like.
- jjgreen 7y ago
  Have you noticed the number of people claiming that Zoom is the subject of an organised campaign? I'm not saying it's an organised whitewashing counter-campaign, but that's what one looks like ... ... and so on
_jal 7y ago
Any time something gets this sort of massive usage boost it is going to be targeted by security researchers. The best way to weather it is to write secure software that doesn't do stupid thngs (like reinventing sudo without protections) and not to slimy things (like trying to deceive your users about your lack of end-to-end encryption). If you choose to do those things instead, people are going to talk about it.
lainga 7y ago
I think directing the Eye of Sauron upon any company-required software is a modern form of collective bargaining. Individually, at many companies around the world, one engineer's concerns about Zoom or w/e will not reach or convince HR. But that same number of engineers all finding and publishing vulns in unison will convince the same number of admin people to not use Zoom. Because it gives a sense of "technical consensus" - the engineering-decision version of solidarity - I guess??
justapassenger 7y ago
It's software that's taking over the world by the storm, suddenly used by countless companies, governments, hospitals, schools, etc. They need scrutiny, especially given that their security record is subpar. Bad actors aren't self-isolating themselves from internet during pandemic. If I were a bad actor, I'd totally go after Zoom as an attack vector, given its sudden adoption, without proper security reviews by organizations.
floatingatoll 7y ago
I think that people are taking discount shorts of the stock (which are unlikely to pay out right now) and then trying to cause price dips to profit from disclosing their information. If someone just released a zero day about Zoom without prior disclosure to Zoom, it would be a useful thing for the SEC to look into more closely.
dang 7y ago
It's a side effect of the flurry of covid stories. See https://news.ycombinator.com/item?id=22751116 https://news.ycombinator.com/item?id=22751116 for more.

asveikau 7y ago

There was plenty of criticism before. Remember they were the company that ran an unauthenticated web server bound to localhost so that any website could make requests to it and get the video stream. And they made it so that an uninstall wouldn't remove that. That was July. https://www.schneier.com/blog/archives/2019/07/zoom_vulnerabil.html https://www.schneier.com/blog/archives/2019/07/zoom_vulnerab...

mkaymalright 7y ago
Excuse me, what the f? Link? edit: Thanks
jscholes 7y ago
> unauthenticated web server bound to localhost so that any website could make requests to it and get the video stream I read the linked article. At no point did it (or as far as I can recall any of the coverage at the time) say that the video stream data could be accessed via the local web server. The problem was already bad; no need to make spurious claims to make it worse.
- asveikau 7y ago
  Ok, maybe that was my slight misreading of the situation. It definitely involved use of the webcam without user consent, however. And an attacker could make you join a meeting that they control, effectively being able to watch and hear you.
  - jscholes 7y ago
    Oh absolutely. I'm not trying to downplay the serious nature of the vulnerability, particularly because it also lead to the possibility of remote code execution. Just want to keep the record straight that at no point did this vulnerability allow people to actively spy on your legitimate meetings.
fragmede 7y ago
Zoom IPOd in mid-April 2019. In terms of "start up that made it" or "growing pains", this is what happens when you don't hire a seasoned PR team (and even then). No one was looking all that hard at Zoom's technical practices because no one technical cared that much. Now that the UK Prime Minister is tweeting screenshots which include the zoom meeting ID, it's suddenly become a lot more interesting to lots of people, some of them less scrutable than others. Zoom's older competitors; Microsoft (Skype), Google (Meet), WebEx, etc have undergone similar scrutiny with the similar results - bad press followed by engineering fix.
- asveikau 7y ago
  It actually sounds more like technical hiring and engineering culture was not good, rather than just PR. I know we all make mistakes, bugs happen, etc. However, if you can't reason through why it's not safe to bind an HTTP server to localhost and consider clients trusted on a laptop that might also run a web browser ... This and other prominent bugs suggests that among other things, security was not a part of the culture or mindset of the rank and file. I don't think you can use "it's a startup, bro" as an excuse for that.

Minor49er 7y ago

I've noticed this too. It's also on other news sites like Slashdot. It comes off like a smear campaign

dgritsko 7y ago
I don't think so, the criticism seems well-deserved. It just seems like a natural effect of being thrust into mainstream consciousness due to more people using it while working from home.
- plussed_reader 7y ago
  The edge cases get a lot more attention when the sample size is increased.

dmitriid 7y ago

Because many more people have started using it and are running into a multitude of issues... with everything. It doesn't help that Zoom has a history of bad practices. Just last year Apple had to issue a silent security updates to macOS to patch Zoom's zero day vulnerabilities Zoom denied existed.

MPSimmons 7y ago

That's just because their approach to building secure software for the masses is garbage. This software smells like it started as an internal tool for a company that escaped.

bentcorner 7y ago
It certainly has a weird janky feel for how it integrates with the system. My wife sent me a link to join a meeting for testing. Normally when you have a link and want to have a desktop app use it there's some protocol handler that's registered with the app. Nope - you click the link, it downloads what appears to be an on-the-fly generated exe that talks to desktop zoom. I get the "remove all friction" sentiment but it feels so off compared to any other web/desktop stack of technology.

BurningFrog 7y ago

I'm not at all saying this is one, but this is what an organized campaign looks like.

jjgreen 7y ago
Have you noticed the number of people claiming that Zoom is the subject of an organised campaign? I'm not saying it's an organised whitewashing counter-campaign, but that's what one looks like ... ... and so on

_jal 7y ago

Any time something gets this sort of massive usage boost it is going to be targeted by security researchers. The best way to weather it is to write secure software that doesn't do stupid thngs (like reinventing sudo without protections) and not to slimy things (like trying to deceive your users about your lack of end-to-end encryption). If you choose to do those things instead, people are going to talk about it.

lainga 7y ago

I think directing the Eye of Sauron upon any company-required software is a modern form of collective bargaining. Individually, at many companies around the world, one engineer's concerns about Zoom or w/e will not reach or convince HR. But that same number of engineers all finding and publishing vulns in unison will convince the same number of admin people to not use Zoom. Because it gives a sense of "technical consensus" - the engineering-decision version of solidarity - I guess??

justapassenger 7y ago

It's software that's taking over the world by the storm, suddenly used by countless companies, governments, hospitals, schools, etc. They need scrutiny, especially given that their security record is subpar. Bad actors aren't self-isolating themselves from internet during pandemic. If I were a bad actor, I'd totally go after Zoom as an attack vector, given its sudden adoption, without proper security reviews by organizations.

floatingatoll 7y ago

I think that people are taking discount shorts of the stock (which are unlikely to pay out right now) and then trying to cause price dips to profit from disclosing their information. If someone just released a zero day about Zoom without prior disclosure to Zoom, it would be a useful thing for the SEC to look into more closely.

dang 7y ago

It's a side effect of the flurry of covid stories. See https://news.ycombinator.com/item?id=22751116 https://news.ycombinator.com/item?id=22751116 for more.