4 ms·

This is a knee-jerk reaction. Zoom was indirectly sending information to Facebook as part of their Facebook SDK integration to enable login, not directly as par

This is a knee-jerk reaction. Zoom was indirectly sending information to Facebook as part of their Facebook SDK integration to enable login, not directly as part of explicit information gathering. Any app that integrates with the Facebook SDK does this, and they've also patched it already [1]. The supposed root exploit found in Zoom also requires physical, logged-in access to the machine, at which point a Zoom exploit is the least of your problems [2]. Zoom is a solid piece of software, and the developers are responsive and seem to care. I'm disappointed to see it getting dumped on during the past few days. A cynic might even suspect a co-ordinated campaign by Cisco, considering Zoom was started by frustrated ex-Cisco employees and has had runaway growth during the viral crisis, while the same cannot be said for Cisco's competitor product WebEx. [1] https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebook-sdk-in-ios-client/ https://blog.zoom.us/wordpress/2020/03/27/zoom-use-of-facebo... [2] https://9to5mac.com/2020/04/01/new-zoom-bugs-takeover-macs-cam-mic-root/ https://9to5mac.com/2020/04/01/new-zoom-bugs-takeover-macs-c...

toasterlovin 7y ago
> This is a knee-jerk reaction. When you make weapons technology (as SpaceX does; rockets are weapons technology) and are involved in launching military satellites (as SpaceX is), you kinda have to take security issues seriously.
yumraj 7y ago
> This is a knee-jerk reaction. Large part of, if not entire, Zoom engineering is based in China, so just based on that singular fact IMHO this is not at all a knee-jerk reaction. Add to that numerous security found in Zoom just over the last few days, and I'm surprised why more companies are not doing the same.
- shrewduser 7y ago
  exactly, plus when you're spaceX or a similar tech company it's much better to be safe than sorry. you don't always have the luxury to assume good intentions.
- damanamathos 7y ago
  Webex also has a large engineering team in China too. The senior people are all in the US though.
cynix 7y ago
> Zoom is a solid piece of software, and the developers are responsive and seem to care. The dodgy things they've been doing suggest otherwise. * Hijacking package preflight script rather than standard package installation mechanism, so their software is installed before the user clicks Install. * Installing a hidden web server without user consent.
- TwoBit 7y ago
  Claiming they have end to end encryption when they don't.
- vbezhenar 7y ago
  That's more about management decisions and unethical developers. It still could be a solid software despite those issues.
  - kempbellt 7y ago
    Does it matter which part of Zoom is causing the issue? It ends up making it shady either way.
oh_sigh 7y ago
From the article it seems like Elon is mostly worried about meeting IDs leaking and letting any random connect: > The FBI’s Boston office on Monday issued a warning about Zoom, telling users not to make meetings on the site public or share links widely after it received two reports of unidentified individuals invading school sessions, a phenomenon known as “zoombombing.”
Aaargh20318 7y ago
> Zoom is a solid piece of software, and the developers are responsive and seem to care. I get the exact opposite impression. Not just due to these bugs, but also the hidden webserver thing [1] a while back. Recurring theme in this (the webserver and the installer issue) seems to be an unhealthy obsession with reducing the number of clicks the user needs to perform. They deliberately chose dubious, hacky solutions over doing things the right way due to this. It makes you wonder what other bad decisions they made in the client or server code. [1] https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-server-automatic-removal-silent-update-webcam-vulnerability https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-s...
013a 7y ago
Decisions like this have less to do with "what are you doing now" and "what was your intention", and more to do with "is there a pattern" which is an externally surfaced signal that something deeper is going on with their engineering organization, long term business plans etc. Zoom has a pattern of abusing users' trust. Ok, maybe its not intentional, but increasingly, that doesn't matter in security discussions. The fact that it was unintentional is a concern itself. Maybe they lack discipline, or leadership, or something; I'm not asserting to know. But, its no longer good enough to simply say "we're sorry, it was an accident".
kerng 7y ago
Companies that are under ITAR take security indeed seriously- this is not your average ad-selling business.
Jedd 7y ago
> I'm disappointed to see it getting dumped on during the past few days. They have what is commonly referred to as form. Consider the past year's highest voted stories whose title includes the word 'zoom' https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=false&query=zoom&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=fal... This is certainly not a 'knee-jerk reaction' to the use of the Facebook SDK, but presumably extrapolates from the history of false uninstallation, insecurity by obscurity, false advertising, etc. Each of those things has been, as you intimate, patched or resolved -- but does that give you increasing or decreasing confidence in their product and priorities?
saagarjha 7y ago
> The supposed root exploit found in Zoom also requires physical, logged-in access to the machine, at which point a Zoom exploit is the least of your problems No, it does not; 9to5Mac is just playing a game of telephone from the original blog post and the actual issue only requires code execution on the machine.

toasterlovin 7y ago

> This is a knee-jerk reaction. When you make weapons technology (as SpaceX does; rockets are weapons technology) and are involved in launching military satellites (as SpaceX is), you kinda have to take security issues seriously.

yumraj 7y ago

> This is a knee-jerk reaction. Large part of, if not entire, Zoom engineering is based in China, so just based on that singular fact IMHO this is not at all a knee-jerk reaction. Add to that numerous security found in Zoom just over the last few days, and I'm surprised why more companies are not doing the same.

shrewduser 7y ago
exactly, plus when you're spaceX or a similar tech company it's much better to be safe than sorry. you don't always have the luxury to assume good intentions.
damanamathos 7y ago
Webex also has a large engineering team in China too. The senior people are all in the US though.

cynix 7y ago

> Zoom is a solid piece of software, and the developers are responsive and seem to care. The dodgy things they've been doing suggest otherwise. * Hijacking package preflight script rather than standard package installation mechanism, so their software is installed before the user clicks Install. * Installing a hidden web server without user consent.

TwoBit 7y ago
Claiming they have end to end encryption when they don't.
vbezhenar 7y ago
That's more about management decisions and unethical developers. It still could be a solid software despite those issues.
- kempbellt 7y ago
  Does it matter which part of Zoom is causing the issue? It ends up making it shady either way.

oh_sigh 7y ago

From the article it seems like Elon is mostly worried about meeting IDs leaking and letting any random connect: > The FBI’s Boston office on Monday issued a warning about Zoom, telling users not to make meetings on the site public or share links widely after it received two reports of unidentified individuals invading school sessions, a phenomenon known as “zoombombing.”

Aaargh20318 7y ago

> Zoom is a solid piece of software, and the developers are responsive and seem to care. I get the exact opposite impression. Not just due to these bugs, but also the hidden webserver thing [1] a while back. Recurring theme in this (the webserver and the installer issue) seems to be an unhealthy obsession with reducing the number of clicks the user needs to perform. They deliberately chose dubious, hacky solutions over doing things the right way due to this. It makes you wonder what other bad decisions they made in the client or server code. [1] https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-server-automatic-removal-silent-update-webcam-vulnerability https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-s...

013a 7y ago

Decisions like this have less to do with "what are you doing now" and "what was your intention", and more to do with "is there a pattern" which is an externally surfaced signal that something deeper is going on with their engineering organization, long term business plans etc. Zoom has a pattern of abusing users' trust. Ok, maybe its not intentional, but increasingly, that doesn't matter in security discussions. The fact that it was unintentional is a concern itself. Maybe they lack discipline, or leadership, or something; I'm not asserting to know. But, its no longer good enough to simply say "we're sorry, it was an accident".

kerng 7y ago

Companies that are under ITAR take security indeed seriously- this is not your average ad-selling business.

Jedd 7y ago

> I'm disappointed to see it getting dumped on during the past few days. They have what is commonly referred to as form. Consider the past year's highest voted stories whose title includes the word 'zoom' https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=false&query=zoom&sort=byPopularity&type=story https://hn.algolia.com/?dateRange=pastYear&page=0&prefix=fal... This is certainly not a 'knee-jerk reaction' to the use of the Facebook SDK, but presumably extrapolates from the history of false uninstallation, insecurity by obscurity, false advertising, etc. Each of those things has been, as you intimate, patched or resolved -- but does that give you increasing or decreasing confidence in their product and priorities?

saagarjha 7y ago

> The supposed root exploit found in Zoom also requires physical, logged-in access to the machine, at which point a Zoom exploit is the least of your problems No, it does not; 9to5Mac is just playing a game of telephone from the original blog post and the actual issue only requires code execution on the machine.