3 ms·

There was plenty of criticism before. Remember they were the company that ran an unauthenticated web server bound to localhost so that any website could make re

There was plenty of criticism before. Remember they were the company that ran an unauthenticated web server bound to localhost so that any website could make requests to it and get the video stream. And they made it so that an uninstall wouldn't remove that. That was July. https://www.schneier.com/blog/archives/2019/07/zoom_vulnerabil.html https://www.schneier.com/blog/archives/2019/07/zoom_vulnerab...

mkaymalright 7y ago
Excuse me, what the f? Link? edit: Thanks
jscholes 7y ago
> unauthenticated web server bound to localhost so that any website could make requests to it and get the video stream I read the linked article. At no point did it (or as far as I can recall any of the coverage at the time) say that the video stream data could be accessed via the local web server. The problem was already bad; no need to make spurious claims to make it worse.
- asveikau 7y ago
  Ok, maybe that was my slight misreading of the situation. It definitely involved use of the webcam without user consent, however. And an attacker could make you join a meeting that they control, effectively being able to watch and hear you.
  - jscholes 7y ago
    Oh absolutely. I'm not trying to downplay the serious nature of the vulnerability, particularly because it also lead to the possibility of remote code execution. Just want to keep the record straight that at no point did this vulnerability allow people to actively spy on your legitimate meetings.
fragmede 7y ago
Zoom IPOd in mid-April 2019. In terms of "start up that made it" or "growing pains", this is what happens when you don't hire a seasoned PR team (and even then). No one was looking all that hard at Zoom's technical practices because no one technical cared that much. Now that the UK Prime Minister is tweeting screenshots which include the zoom meeting ID, it's suddenly become a lot more interesting to lots of people, some of them less scrutable than others. Zoom's older competitors; Microsoft (Skype), Google (Meet), WebEx, etc have undergone similar scrutiny with the similar results - bad press followed by engineering fix.
- asveikau 7y ago
  It actually sounds more like technical hiring and engineering culture was not good, rather than just PR. I know we all make mistakes, bugs happen, etc. However, if you can't reason through why it's not safe to bind an HTTP server to localhost and consider clients trusted on a laptop that might also run a web browser ... This and other prominent bugs suggests that among other things, security was not a part of the culture or mindset of the rank and file. I don't think you can use "it's a startup, bro" as an excuse for that.

mkaymalright 7y ago

Excuse me, what the f? Link? edit: Thanks

jscholes 7y ago

> unauthenticated web server bound to localhost so that any website could make requests to it and get the video stream I read the linked article. At no point did it (or as far as I can recall any of the coverage at the time) say that the video stream data could be accessed via the local web server. The problem was already bad; no need to make spurious claims to make it worse.

asveikau 7y ago
Ok, maybe that was my slight misreading of the situation. It definitely involved use of the webcam without user consent, however. And an attacker could make you join a meeting that they control, effectively being able to watch and hear you.
- jscholes 7y ago
  Oh absolutely. I'm not trying to downplay the serious nature of the vulnerability, particularly because it also lead to the possibility of remote code execution. Just want to keep the record straight that at no point did this vulnerability allow people to actively spy on your legitimate meetings.

fragmede 7y ago

Zoom IPOd in mid-April 2019. In terms of "start up that made it" or "growing pains", this is what happens when you don't hire a seasoned PR team (and even then). No one was looking all that hard at Zoom's technical practices because no one technical cared that much. Now that the UK Prime Minister is tweeting screenshots which include the zoom meeting ID, it's suddenly become a lot more interesting to lots of people, some of them less scrutable than others. Zoom's older competitors; Microsoft (Skype), Google (Meet), WebEx, etc have undergone similar scrutiny with the similar results - bad press followed by engineering fix.

asveikau 7y ago
It actually sounds more like technical hiring and engineering culture was not good, rather than just PR. I know we all make mistakes, bugs happen, etc. However, if you can't reason through why it's not safe to bind an HTTP server to localhost and consider clients trusted on a laptop that might also run a web browser ... This and other prominent bugs suggests that among other things, security was not a part of the culture or mindset of the rank and file. I don't think you can use "it's a startup, bro" as an excuse for that.