16 ms·

A Message to Our Users

397 points by casca 7y ago

NKosmatos 7y ago
A message in the right direction, but they need to solve the recent macOS security issues. Let’s give them the time to (transparently) correct all the recently reported issues.
- laumars 7y ago
  It's a template PR / sales pitch talking about how great they are and how they've had to adapt during the COVID-19 crisis (all of which aren't relevant to the security and privacy complaints being made) and there's only a boilerplate message about how they care about their users....and it's such a generic message it could have been ripped out of any other correspondence sent from any other company. Nothing about that message came across as sincere. Also one of the biggest core issues (their installer) was widely reported and condemned last year (or was it the year before?) so these aren't all new issues coming to light. In fact blaming the visibility of these problems to an influx of new users (re COVID-19) is just dishonest.
  - ornornor 7y ago
    Because we’re technical and can smell the BS miles away. But a lot of the people deciding whether to keep using zoom at their corporation aren’t technical and it might be reassuring enough for them to keep using it. Not saying that’s ok but here we are.
    - laumars 7y ago
      I understand how PR works (literally my first words said it was PR) but that wasn't the point the OP was making to which I was responding. They said this was a message in the right direction and I'm saying this message doesn't mean nor commit them to anything.
      - ornornor 7y ago
        I agree with you, I was only deploring that it will work on most of the people calling the shots. Not with me. But I have to use zoom because our CEO says so.
        laumars 7y ago
        I think you're underestimating a CEO's ability to smell bullshit. In fact many will have written similar letters themselves. The difference is: a CEO usually wouldn't care about security nor privacy violations like this because it's unlikely to affect the bottom line of the business they're managing. Thankfully most (in fact all) places I've worked, it's not the CEO who decides which video conferencing (et al) solution people use, he delegates that responsibility to his CTO or equivalent. Who has almost always then delegated that decision to me :)
    - AgloeDreams 7y ago
      Plus the end user isn't the person who chooses, Zoom is a great monetary value if you don't know the technical downsides.
    - floatingatoll 7y ago
      “We’re technical” is no excuse for a pitchfork mob. I’m technical and HN’s reply feels more like echo-chamber than a reasoned consideration of what they said. Almost every comment as of now is people reacting to the tone and dialect. It’s like there’s nothing to object to technically and so the mob has turned their rage onto speech patterns.
      - klibertp 7y ago
        With topics like this it's worth waiting for ca. 12h (depending on your timezone) and then reading the whole page of comments at once. I'm here 4h after you, and I saw 2 most upvoted comments as pretty sympathetic if not outright supportive to the company. There's a lot of discussion below them, with both sides being represented near-equally. There are some bad comments - one or several words of generic dismissal or insults, and one lengthy incoherent rant - but they are mostly flagged, dead, or downvoted to the bottom of the page. I believe using HN (for whatever reason) is a skill in its own right. If you want to use it as a tool for escaping your own echo-chamber, it takes some more thought to get right. Once you do, it works a significant percentage of the time, which is kind of impressive for a simple marketing platform of the Y Combinator (which is just a bunch of people with money and a bunch of people wanting that money to build or expand their business).
      - laumars 7y ago
        > It’s like there’s nothing to object to technically and so the mob has turned their rage onto speech patterns. I’m usually the first to roll my eyes at such mobs but this case is different. When you have a company that has a documented past of privacy and security violations and then releases a letter saying “sorry about the new reported problems but you wouldn’t have known about it if we weren’t so popular lately,” you can hardly blame us for getting ranty. It just demonstrates that fixing those problems was never a priority and thus that press release is really just meaningless platitudes.
        floatingatoll 7y ago
        I absolutely blame us for pitchfork mob behavior in the initial reply, even if there’s a risk that Zoom is misbehaving intentionally. Theories about their motivations are no excuse for this. There is never an excuse for this. This behavior is unprofessional of us, disrespectful of us, and makes HN look no better than 4chan or Reddit to anyone who sees us doing so.
  - m463 7y ago
    It also sort of says "think of the children" so they can continue their remote education. with zoom. :)
- AgloeDreams 7y ago
  And maybe performance too. It sucks. Watching a video call shouldn't eat 50% CPU on a rather well equipped iMac 4K.
gchokov 7y ago
I am tired of reading such statements. They are like a playbook when things get wrong. Zoom had privacy and user invading issues years back. They didn't learn their lesson back then with the MacOS installers, and continued to assure us they are taking the "right steps". My company have stopped using Zoom and we'll never go back.
- bamboozled 7y ago
  What do you use instead?
  - mritchie712 7y ago
    exactly, like Google Meet is "better"? Zoom got called out and they're going to fix these things. Anyone you jump to is going to have different or maybe some of the same issues.
  - kemonocode 7y ago
    At my company we just switched to Jitsi Meet. Fulfills our needs, works with just a browser, and we can be assured that our data remains ours as we deployed it locally.
- cookie_monsta 7y ago
  At least they didn't tell us that our privacy was important to them. Hard to believe that you still hear that ol warhorse
  - deleted 7y ago
    [deleted]
  - cookie_monsta 7y ago
    Oops - spoke too soon: > “Zoom takes its users’ privacy, security, and trust extremely seriously,” the spokesman said https://www.theguardian.com/technology/2020/apr/02/zoom-technology-security-coronavirus-video-conferencing https://www.theguardian.com/technology/2020/apr/02/zoom-tech...
nelsonic 7y ago
What is a security focussed open source / self-hosted alternative to Zoom with comparable UX?
- jannemann 7y ago
  https://jitsi.org/ https://jitsi.org/
  - fsflover 7y ago
    https://meet.jit.si https://meet.jit.si
Msurrow 7y ago
I think thats fair. All of us who have written and deployed software know that a change in the onboarding/new users rate like this would be a punch in the face that would knock any SW team on its ass. And it would take anyone a few days to get back up. The important part is the leaderships reaction to the situation. Compare to something like Boeing. Zoom acknowledges facts, takes responsibilty and starts fixing things. Boeings reaction to its product killing hundreds of people was “Lol user error. RTFM”. That is (apparently) what acceptable leadership can look like.. Any sw product has issues. The question is what the company does about it
- Nullabillity 7y ago
  Err, no. It would be understandable if their servers buckled under the load or something. Zoom's blatant disregard for their users' security and privacy is unacceptable regardless of whether they have 5 or 5 million users. > Any sw product has issues. The question is what the company does about it See https://news.ycombinator.com/item?id=20389812 https://news.ycombinator.com/item?id=20389812, https://news.ycombinator.com/item?id=20390755 https://news.ycombinator.com/item?id=20390755
  - JohnJamesRambo 7y ago
    Other than Zoom stockholders, I’m unsure why this comment is being downvoted. It seems entirely factual and provides references.
    - deleted 7y ago
      [deleted]
  - xenonite 7y ago
    And more recently, Zoom Is Leaking Peoples' Email Addresses and Photos to Strangers https://news.ycombinator.com/item?id=22753675 https://news.ycombinator.com/item?id=22753675
    - ninkendo 7y ago
fvdessen 7y ago
The moral of the story is once again that focusing on user acquisition at all costs is an effective strategy. MongoDB disregarded reliability, Youtube disregarded copyright, Reddit faked comments, Facebook disregarded privacy. Yet they were all ultimately successful. Could it have happened differently ? Not so sure.
- BostonFern 7y ago
  "Move fast and break things." I'm afraid getting there first is pretty much imperative.
  - Loughla 7y ago
    Honestly, I don't understand why this site seems to hate Zoom so much. They're doing what all of the large players have done in the past. Why aren't they being congratulated for their success? This is not meant to be snarky. They are literally living by the move fast and break things motto. Growth at the expense of everything else to win the market first, fix it second. How are they not the golden child of SV right now?
    - jeltz 7y ago
      People hate those large players too. Just look at how much hate MongoDB got for ignoring both reliability and safety.
    - kkarakk 7y ago
      It's just 2020 speaking, people outraged on the behalf of users who honestly don't care and just want easy to use videochatting. This is just a symptom of ycombinator becoming a more widely known social network. All the malaises of social networks like pointless discussions about morality without any concrete solutions are coming along with that.
      - divbzero 7y ago
        > pointless discussions about morality without any concrete solutions The correct response to many moral issues is not to create concrete solutions, but simply to stop people from doing bad things.
Nullabillity 7y ago
"Oh no, it used to be alright that we are shady as hell, because, you see, we never thought anyone would actually use our service!" Give me a break..
jbverschoor 7y ago
What a load of crap... First, some background: our platform was built primarily for enterprise customers – large institutions with full IT support These new, mostly consumer use cases have helped us uncover unforeseen issues with our platform Never ever gonna use zoom.. I got rid of it a long time ago when I found out about the malware...
rado 7y ago
BS
hc91 7y ago
Translation: "We are SO sorry that we got caught and that you feel this way about us. Let's see if we can react to this situation fast enough before everyone will start replacing us with alternatives that at least have a better reputation." ... yeah, give me a break!
seemslegit 7y ago
This is "we are sorry for getting caught" changes-nothing nonpology. The use of "end to end encryption" designation was no confusion, it was deception - it is implausible that this could have been done accidentally or as a result of a misunderstanding without engineers warning managers that this is not how zoom works and being overridden in their objections to communicate it as such. They also double down on data collection. Disclosure does not establish consent and "we do not sell data" is a red herring because data can still be shared with third parties for business purposes against the interests of the users without being overtly sold (not to mention with governments under various "compelled cooperation" arrangements) and the entire policy can be subject to retroactive change without recourse. The fact that they were targeting organizations with IT support is irrelevant except maybe to discredit the people within those organizations who greenlighted Zoom. The saddest part is that it is unlikely any of the competing corporate offers are any better in any of those respect, but then they are not being actively pumped these days.
- jwr 7y ago
  > This is "we are sorry for getting caught" changes-nothing nonpology. True, but I am still happy to see it. It shows that they got burned and that they noticed and felt the burn. It remains to be seen how they follow up — I will be watching closely.
  - seemslegit 7y ago
    People who care and have the time to spare might, but this is standard PR crisis mitigation technique and the goal is to have a large mass of the users thinking "ah, this was just a mistake made under pressure in crazy times, zoom is ok now, still convenient".
- oneVoiceOnHN 7y ago
  They need to a better logo and a bigger advertising budget showing hip 20 year old dancing to indie music. It worked for i-nother company.
hc91 7y ago
I fully agree with everything you have said. I have made a similar comment and it got downvoted to hell. I do not understand HN anymore.
- seemslegit 7y ago
  This is because an increasingly large percentage of the people here have to deal with the dissonance of having to make their living in an industry and business culture that depends on those kind of practices and consequently rewards and promotes them.
  - hc91 7y ago
    Possibly. Also looks like (almost) all the critical comments towards this article get magically downvoted - seriously check it out. Legit question - what happens when your karma gets to zero? Do you get banned?
    - bdefore 7y ago
      It is against HN community guidelines to comment about comment voting because it adds nothing substantial to the discussion.
      - seemslegit 7y ago
        > because it adds nothing substantial to the discussion. Substantial to whom ? Often people who downvote will prvoide additional information as to their reasoning which can be substantial or insubstantial like any other comment.
        TeMPOraL 7y ago
        If a downvoter didn't share their reasoning already, it's unlikely they will be prompted by a general "why is this getting downvoted?" comment. That's why site rules say you should not ask about downvotes.
tyingq 7y ago
"Removed the attendee attention tracker feature." Oh, I missed that one. https://support.zoom.us/hc/en-us/articles/115000538083-Attendee-attention-tracking https://support.zoom.us/hc/en-us/articles/115000538083-Atten...
empressplay 7y ago
I know this is banal but fk these guys.
- dang 7y ago
  Please don't do this here. You may not owe "these guys" better, but you owe this community better if you're posting to it. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
pjfunk 7y ago
"We didn't design for for scaling overnight" is different from "we did care for security until we got caught" However small or big, a company shouldn't be selling data without user consent, shouldn't use terms end-to-end encryption while make otherwise claims. This behaviour should be punishable
- piokoch 7y ago
  Facebook did that (e.g. https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana..., funny stuff they did to circumvent GDPR). And Who cared? There was some noise in the media and that's all. Was Mark Zuckerberg punished? For me all this Zoom bashing looks a bit as if those guys stepped on someone's toe, who does not like the idea of having another competitor in the social media/online advertising area.
oliwarner 7y ago
Maaaan, the /wordpress/ in the URL really knocks home how slapdash this whole operation is. And this wasn't anything but an acknowledgement that they're not qualified to produce the software they're distributing. They still don't even know what they don't know.
- justusthane 7y ago
  What an odd thing to criticize them about. Privacy and security issues aside (which are serious), it seems to be an extremely well engineered product. They’ve handled the absolute explosion in users with nary a glitch, and in my experience it’s the _only_ video conferencing solution that “just works”. It’s obvious that there’s some pretty impressive engineering behind it. I’m not sure exactly what your critique about Wordpress is. Is it that they’re using Wordpress, like 30% of the other websites in the world? Or is it that they didn’t bother removing it from the URL? Start keeping an eye out for “/wp-content/“ in the path of images or downloads on websites. You’ll be amazed.
- alexpetralia 7y ago
  Do you really think they're not "qualified" to produce video conferencing software? Does that seem like a reasonable statement? I am genuinely curious if you think a public company with millions of users and fairly reliable quality is not "qualified" to deliver its own product.
  - oliwarner 7y ago
    I'm genuinely curious if you think that company status, bank balance or number of users translates into software quality. I posit that Zoom has been right place, right price. Simple as that. The software is demonstrably hot trash. Not just at client endpoints but structurally.
    - detaro 7y ago
      Right place, right price, pretty-much flawlessly working video chats. The latter point is just as important (there's a bunch of free video chat products), and suggests it's not completely trash.
zxj930057911 7y ago
Yes
yalogin 7y ago
Through this I learnt, for the first time, that they also send data to Linkedin.
- tonyaiken 7y ago
  That’s a enterprise integration, you can view participants’ LinkedIn profile which is very helpful if implemented right. https://marketplace.zoom.us/apps/ex1KIG08R3-ctKCi65YePA https://marketplace.zoom.us/apps/ex1KIG08R3-ctKCi65YePA
  - rjacksonm1 7y ago
    >With Zoom's LinkedIn Sales Navigator integration, you’ll build connections and instantly gain insights about your meeting participants. Sounds pretty creepy. I assume participants have to opt into this?
  - yalogin 7y ago
    No they explicitly said Linkedin sales api.
tobr 7y ago
I struggle to understand why the sudden influx of new users would affect these security problems in any way. OK, more people are affected, but the problems are surely the same regardless of how many users they have. To me it just comes across as an attempt to deliberately confuse the issue.
- organsnyder 7y ago
  They address this specifically in the article: > Dedicated journalists and security researchers have also helped to identify pre-existing ones. Sure, you could translate that as "more eyeballs have uncovered our sloppy security" if you'd like, but it doesn't strike me as dishonest.
  - jtdev 7y ago
    This is cunning PR diversionary bullshit.
    - edoceo 7y ago
      Not cunning; it's a low effort hand wave. The rest is true.
      - EForEndeavour 7y ago
        If a team of career PR folks meticulously iterating on the precise wording of this message to frame the narrative in their favour doesn't count as "cunning" to you, I don't know what would.
        NateEag 7y ago
        I believe "cunning" is not about intent, but the action's effectiveness. As an attempt to mislead or imply that there are no problems here, this is pretty much a failure, and thus not at all cunning.
        7y ago
ken 7y ago
Zoom has had major security issues for years, and they've always brushed them off as not a big deal. This isn't an isolated incident. If their position is now that the Zoom software was designed for corporate users, e.g., that you're expected to only run it on your own VPN where you can guarantee there's no malicious network traffic, then it should have "NOT FOR CONSUMER USE" plastered all over it. To me, this reads exactly like "Lol user error", except there's no "M" to "RTF" that ever said, for example, that its local web server stayed running after uninstallation and could take control of your camera, or that "E2E" in the Zoom docs doesn't mean the same thing as it means to the rest of the industry. There's no responsibility being taken here. Taking responsibility would be "We fired all our 'security' people who told us we had best-of-breed security, and hired some actual security experts to re-architect our system to provide actual security for our users." What they did here is indistinguishable from "We're sorry we got caught!" except in verbosity.
- zentiggr 7y ago
  Maybe a blog post saying "Yes, we acknowledge that we deliberately ignored major portions of security practices and just did whatever got us market share fastest. We can't change the past, but we're going to clean house and do privacy and security for real from now on, and we hope you'll stick with us, or come back after we've fixed <pointing to all of this>."
  - onli 7y ago
    That's pretty much what this blog post is, with just a little bit more PR speak. And I'm honestly surprised that it is not totally watered down, it's not just PR speak and user blaming, but makes some clear points. The base defense is bad - that it was for less users and contexts before changes nothing - but it at least includes the "we will focus on that now, honestly". That's not bad already.
    - shadowgovt 7y ago
      We could read the PR blurb from the company that engineered for security and privacy before getting features in place users wanted, but we can't. They're not making a blog post because they ran out of runway money, having failed to get a product in user's hands in time for anyone to care about their existence.
juliend2 7y ago
I don't know exactly what is the main security issue right now, but as I understand it, it's mostly related to this: https://www.bleepingcomputer.com/news/security/zoom-lets-attackers-steal-windows-credentials-run-programs-via-unc-links/ https://www.bleepingcomputer.com/news/security/zoom-lets-att... (on Windows). The windows changelog[1] doesn't talk about a version released on April 1st, like the press release says[2]. So is the only way to mitigate that issue for non-techie users is to deactivate the chat feature for all conversations? [1] https://support.zoom.us/hc/en-us/articles/201361953-New-Updates-for-Windows https://support.zoom.us/hc/en-us/articles/201361953-New-Upda... [2] https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-users/ https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u...
shadowgovt 7y ago
Zoom seems to be another example of the repeating pattern we seem to see from web service software: if the product has good UX, people don't care about the technical issues that aren't in their faces. At least, they don't care in any tangible way like "They stop using the product." Remember when Twitter was incredibly unstable? That was fine when it had only ten thousand users. They had to fix it fast when it had a million. But the thing is: that seems to be viable software practice (rush on features, forget about the robustness and the corner cases) because it keeps working.
yspeak 7y ago
I'm really not clear where such hostility in the comments is coming from towards a company that is offering free services during a worldwide pandemic albeit with a marketing upside. Sure there are issues but Zoom appears to be addressing them. Times like these expose or highlight vulnerabilities to fix and ultimately serve as an opportunity to make these services better. I assume good faith in the comments and that they are not competitors or security services advertising their chops.
Quanttek 7y ago
> "On March 29th, we updated our privacy policy to be more clear and transparent around what data we collect and how it is used – explicitly clarifying that we do not sell our users’ data, we have never sold user data in the past, and have no intention of selling users’ data going forward." That is such a dishonest way of framing it. No one was really concerned whether they would "sell" data. The issue was with the exorbitant amount of data they collect and its analysis for commercial purposes, be it ads (which doesn't involve selling data), targeted pricing or providing access to corporate admins.
- amiga_500 7y ago
  Surely as this comes from the FB lib zoom are not an outlier here? Why the sudden pearl clutching at zoom when everyone is using facebook, google and any other site that has facebook tracking built in?
  - sitzkrieg 7y ago
    cant help but feel like hit squads from the lagging competition
    - amiga_500 7y ago
      I agree, this level of synthetic concern doesn't feel like "grass roots". MS did a terrible job with Skype and Lync. No doubt they were expecting to be able to bind it to exchange server and then create a coupling that embedded into an effective monopoly, creating yet another bad user experience that somehow becomes "the norm". Hopefully at some point MS will compete by improving their products and we will have a better WFH experience.
  - AlexandrB 7y ago
    I work very hard to keep Facebook out of my life. I run an ad-blocker and I don't log into my (inert) Facebook account outside of privacy mode (or a VM). Unfortunately, I don't have a choice about using Zoom. So it sucks that I'm effectively getting backdoored with this nonsense. Why is it OK to expose my information to an advertising company like Facebook without asking for permission first? Because everyone else does it?
cmcd 7y ago
> "We want to start by apologizing for the confusion we have caused by incorrectly suggesting that Zoom meetings were capable of using end-to-end encryption. Zoom has always strived to use encryption to protect content in as many scenarios as possible, and in that spirit, we used the term end-to-end encryption." Excerpt from their previous release above, only a few hours earlier. Glad to hear they are starting to make improvements but waiting for public backlash to fix issues is a bad sign.
crazygringo 7y ago
Key section: > Over the next 90 days, we are committed to... Enacting a feature freeze, effectively immediately, and shifting all our engineering resources to focus on our biggest trust, safety, and privacy issues. I see a lot of comments here claiming that this blog post is bland corporate apologia, doesn't take responsibility, doesn't change anything. But this seems like a pretty legit turnaround. Overall, they seem to be addressing pretty much everything that's been brought up. They removed the Facebook SDK, they removed attention tracking, they've clarified their encryption policies in detail. One commenter here is asking for more, for punishment, another demands their security team be fired. And I mean, if someone wants to try to sue Zoom for misusing the term E2EE then go for it, but obviously Zoom can't "punish itself" in a blog post, and pinning it on a few bad engineers feels like a scapegoat. This seems to be positive steps, folks. Genuinely not sure what more you could be asking for from a regular for-profit business.
- gizmo385 7y ago
  > One commenter here is asking for more, for punishment, another demands their security team be fired. And I mean, if someone wants to try to sue Zoom for misusing the term E2EE then go for it, but obviously Zoom can't "punish itself" in a blog post, and pinning it on a few bad engineers feels like a scapegoat. A portion of the development community loves to talk about blameless post-mortems and a blame-free culture until a tech company like Zoom does something they don't like.
  - tprynn 7y ago
    I think it's generally a poor assumption to assume that any two internet "crowds" are the same people. Some commenters care about X and some about Y and we can almost never tell what the overlap between those groups is. The hivemind is not as uniform as that.
    - jolmg 7y ago
      Well said, and it applies beyond just "internet" crowds. Some people think whole nationalities work as uniform hiveminds.
ivanfon 7y ago
Off topic, but it would be nice to mention Zoom in the title, it's pretty ambiguous otherwise
_pmf_ 7y ago
I find the whole ganging up against Zoom disgusting. Mac-fanbois-cum-security-experts blaming Zoom for the deficiencies of a) their platform not having a working native teleconferencing solution and b) their platforms arbitrary installer policies. Then there's the issue that Zoom is now suddenly responsible for the complete lack of security awareness of teachers and middle managers who have never before held online classes, and are publicly posting meeting credentials so that everyone can join. All, of course, while the while world is free loading (yes, "you are the product, hurr durr"; great contribution).
oandrei 7y ago
I want to share my solution for remote collaboration and teaching: https://github.com/amkhlv/mathpump3 https://github.com/amkhlv/mathpump3 Professor uses Wacom and Inkscape to draw a picture, which is incrementally transmitted to students' computers. Students, those who have Wacom, may interact. Or just watch. Transmission happens every time the svg file is saved. Transmission requires a RabbitMQ server, which can be easily set up. Basically, a class needs one person who knows Linux, to set up the server. It is intended for scientific collaboration or teaching in small groups of people. I am now using it for teaching my QFT class, although it only has 5 students. In principle, it should scale, but I have not tried it for large groups... Drawing with Wacom in Inkscape is a pleasure, once you get used to it. In some sense, it is more convenient than using a physical blackboard. Although, some training is needed...
- soared 7y ago
  Awesome idea! Is there much overlap in the area where a professor has a wacom and also has a student that knows linux?
deleted 7y ago
[deleted]
Dowwie 7y ago
I think we need to acknowledge the fact that Zoom, and its use of cloud infra, took on 20x peak volume of 2019 within just a few months.
lxe 7y ago
> On March 27th, we took action to remove the Facebook SDK in our iOS client and have reconfigured it to prevent it from collecting unnecessary device information from our users. Sounds like folks at Zoom take privacy and security related feedback pretty seriously.
Nevada-Smith 7y ago
"Thousands of enterprises around the world have done exhaustive security reviews of our user, network, and data center layers and confidently selected Zoom for complete deployment." Interesting that he would point out the failure of thousands of IT departments around the world.
- rchaud 7y ago
  that jumped out to me as well. I'm in a large org that uses Zoom, not company-wide, but certainly in several departments. We have a SaaS questionnaire that vendors need to submit for review as part of the procurement process. With everything that's come out since (not just the iOS client issue), I'm wondering how deep that questionnaire goes with regards to security concerns.
jefftk 7y ago
While I think Zoom has a lot of work to do from a security perspective, overall I think we should be supportive: facilitating -- mostly for free! -- very low friction video calls between an enormous number of isolated people is an incredible service.
jasonv 7y ago
I think this is a necessary move on their part. And they obviously have the business and engineering talent to make a good product (it's better than their competition, I'll grant). But how much of their market share came because of some nefarious business and technical practices? Forgive and forget, 'cause "correction"?
kmtrowbr 7y ago
December 2019: 10M daily participants. March 2020: 200M daily participants. A sustained 20x spike in usage. And it’s still working! I think that’s amazing. Think through this situation — 90,000 schools suddenly using Zoom, children doing their classes. What is most important: option 1) it just works option 2) it’s 100% secure Imagine you were a member of Zoom's team, would you not be justified in feeling proud right now?
- enriquto 7y ago
  > Imagine you were a member of Zoom's team, would you not be justified in feeling proud right now? It has nothing to do with scaling. The problem is the numerous anti-privacy and anti-safety measures that they actively partook in. Those were no "features missed out" due to rapid development. Those were anti-user features purposefully developed in. This is what people are complaining about; and this is what the zoom manifesto is shamefully trying to brush off as if they were related to rapid development or to rapid scaling. If I was a member of the zoom team (who hadn't actively participated in these features), I would be extremely ashamed of my company for spoiling our success with these damaging practices.
  - kmtrowbr 7y ago
    I have to believe the aim of these features was to make it easier for Zoom to be installed and to "just work." I'm inclined to give them the benefit of a doubt right now.
tibiahurried 7y ago
I am sorry, but it is too late. Zoom should have valued more their user's privacy. They clearly didn't and now they are trying to fix it. Too late. Trust is really hard to gain, and once you lose it you are done. As Marc Benioff often says: Trust is the one most important value.
xenocyon 7y ago
I'm pretty new to Zoom. It always seems to take me a while to get to the option of using the web browser instead of the executable. Is there an easy way (e.g. URL structure) to force the web-browser-meeting and skip the download dialog?
- xenocyon 7y ago
  Answering my own question: the URL to use to force using the web browser instead of the download is: http://zoom.us/wc/join/{your-meeting-id} http://zoom.us/wc/join/{your-meeting-id}
talkingtab 7y ago
Zoom added the Facebook SDK. When they got caught they removed it. Great! But what about a statement that they will provide a user-focused third-party security assessment on a regular basis so that users know there are no other issues? People need transparency.
hyko 7y ago
“It takes 20 years to build a reputation and five minutes to ruin it” -Warren Buffet They didn’t even bother to build up a reputation; hard to see how they’re going to build respect for people’s privacy and security into their culture now.
whatok 7y ago
For anyone excusing any of this, Zoom is currently a 34bn dollar company. There really are no "whoops, didn't expect to get this popular" excuses that are legitimate for all of these issues; especially when none of these things have to do with scaling and are instead just boneheaded design decisions.
- Waterluvian 7y ago
  "34 billion" is the fake Silicon Valley price tag. And they get there by rushing like a bunch of idiots to a hollow Hoover Dam of a product that looks great to everyone from the outside.
  - whatok 7y ago
    Zoom is a public company. The CEO owns 4% of it.

397 points by casca 7y ago

A message in the right direction, but they need to solve the recent macOS security issues. Let’s give them the time to (transparently) correct all the recently reported issues.

laumars 7y ago
It's a template PR / sales pitch talking about how great they are and how they've had to adapt during the COVID-19 crisis (all of which aren't relevant to the security and privacy complaints being made) and there's only a boilerplate message about how they care about their users....and it's such a generic message it could have been ripped out of any other correspondence sent from any other company. Nothing about that message came across as sincere. Also one of the biggest core issues (their installer) was widely reported and condemned last year (or was it the year before?) so these aren't all new issues coming to light. In fact blaming the visibility of these problems to an influx of new users (re COVID-19) is just dishonest.
- ornornor 7y ago
  Because we’re technical and can smell the BS miles away. But a lot of the people deciding whether to keep using zoom at their corporation aren’t technical and it might be reassuring enough for them to keep using it. Not saying that’s ok but here we are.
  - laumars 7y ago
    I understand how PR works (literally my first words said it was PR) but that wasn't the point the OP was making to which I was responding. They said this was a message in the right direction and I'm saying this message doesn't mean nor commit them to anything.
    - ornornor 7y ago
      I agree with you, I was only deploring that it will work on most of the people calling the shots. Not with me. But I have to use zoom because our CEO says so.
      - laumars 7y ago
        I think you're underestimating a CEO's ability to smell bullshit. In fact many will have written similar letters themselves. The difference is: a CEO usually wouldn't care about security nor privacy violations like this because it's unlikely to affect the bottom line of the business they're managing. Thankfully most (in fact all) places I've worked, it's not the CEO who decides which video conferencing (et al) solution people use, he delegates that responsibility to his CTO or equivalent. Who has almost always then delegated that decision to me :)
  - AgloeDreams 7y ago
    Plus the end user isn't the person who chooses, Zoom is a great monetary value if you don't know the technical downsides.
  - floatingatoll 7y ago
    “We’re technical” is no excuse for a pitchfork mob. I’m technical and HN’s reply feels more like echo-chamber than a reasoned consideration of what they said. Almost every comment as of now is people reacting to the tone and dialect. It’s like there’s nothing to object to technically and so the mob has turned their rage onto speech patterns.
    - klibertp 7y ago
      With topics like this it's worth waiting for ca. 12h (depending on your timezone) and then reading the whole page of comments at once. I'm here 4h after you, and I saw 2 most upvoted comments as pretty sympathetic if not outright supportive to the company. There's a lot of discussion below them, with both sides being represented near-equally. There are some bad comments - one or several words of generic dismissal or insults, and one lengthy incoherent rant - but they are mostly flagged, dead, or downvoted to the bottom of the page. I believe using HN (for whatever reason) is a skill in its own right. If you want to use it as a tool for escaping your own echo-chamber, it takes some more thought to get right. Once you do, it works a significant percentage of the time, which is kind of impressive for a simple marketing platform of the Y Combinator (which is just a bunch of people with money and a bunch of people wanting that money to build or expand their business).
    - laumars 7y ago
      > It’s like there’s nothing to object to technically and so the mob has turned their rage onto speech patterns. I’m usually the first to roll my eyes at such mobs but this case is different. When you have a company that has a documented past of privacy and security violations and then releases a letter saying “sorry about the new reported problems but you wouldn’t have known about it if we weren’t so popular lately,” you can hardly blame us for getting ranty. It just demonstrates that fixing those problems was never a priority and thus that press release is really just meaningless platitudes.
      - floatingatoll 7y ago
        I absolutely blame us for pitchfork mob behavior in the initial reply, even if there’s a risk that Zoom is misbehaving intentionally. Theories about their motivations are no excuse for this. There is never an excuse for this. This behavior is unprofessional of us, disrespectful of us, and makes HN look no better than 4chan or Reddit to anyone who sees us doing so.
- m463 7y ago
  It also sort of says "think of the children" so they can continue their remote education. with zoom. :)
AgloeDreams 7y ago
And maybe performance too. It sucks. Watching a video call shouldn't eat 50% CPU on a rather well equipped iMac 4K.

gchokov 7y ago

I am tired of reading such statements. They are like a playbook when things get wrong. Zoom had privacy and user invading issues years back. They didn't learn their lesson back then with the MacOS installers, and continued to assure us they are taking the "right steps". My company have stopped using Zoom and we'll never go back.

bamboozled 7y ago
What do you use instead?
- mritchie712 7y ago
  exactly, like Google Meet is "better"? Zoom got called out and they're going to fix these things. Anyone you jump to is going to have different or maybe some of the same issues.
- kemonocode 7y ago
  At my company we just switched to Jitsi Meet. Fulfills our needs, works with just a browser, and we can be assured that our data remains ours as we deployed it locally.
cookie_monsta 7y ago
At least they didn't tell us that our privacy was important to them. Hard to believe that you still hear that ol warhorse
- deleted 7y ago
  [deleted]
- cookie_monsta 7y ago
  Oops - spoke too soon: > “Zoom takes its users’ privacy, security, and trust extremely seriously,” the spokesman said https://www.theguardian.com/technology/2020/apr/02/zoom-technology-security-coronavirus-video-conferencing https://www.theguardian.com/technology/2020/apr/02/zoom-tech...

nelsonic 7y ago

What is a security focussed open source / self-hosted alternative to Zoom with comparable UX?

jannemann 7y ago
https://jitsi.org/ https://jitsi.org/
- fsflover 7y ago
  https://meet.jit.si https://meet.jit.si

Msurrow 7y ago

I think thats fair. All of us who have written and deployed software know that a change in the onboarding/new users rate like this would be a punch in the face that would knock any SW team on its ass. And it would take anyone a few days to get back up. The important part is the leaderships reaction to the situation. Compare to something like Boeing. Zoom acknowledges facts, takes responsibilty and starts fixing things. Boeings reaction to its product killing hundreds of people was “Lol user error. RTFM”. That is (apparently) what acceptable leadership can look like.. Any sw product has issues. The question is what the company does about it

Nullabillity 7y ago
Err, no. It would be understandable if their servers buckled under the load or something. Zoom's blatant disregard for their users' security and privacy is unacceptable regardless of whether they have 5 or 5 million users. > Any sw product has issues. The question is what the company does about it See https://news.ycombinator.com/item?id=20389812 https://news.ycombinator.com/item?id=20389812, https://news.ycombinator.com/item?id=20390755 https://news.ycombinator.com/item?id=20390755
- JohnJamesRambo 7y ago
  Other than Zoom stockholders, I’m unsure why this comment is being downvoted. It seems entirely factual and provides references.
  - deleted 7y ago
    [deleted]
- xenonite 7y ago
  And more recently, Zoom Is Leaking Peoples' Email Addresses and Photos to Strangers https://news.ycombinator.com/item?id=22753675 https://news.ycombinator.com/item?id=22753675
  - ninkendo 7y ago

fvdessen 7y ago

The moral of the story is once again that focusing on user acquisition at all costs is an effective strategy. MongoDB disregarded reliability, Youtube disregarded copyright, Reddit faked comments, Facebook disregarded privacy. Yet they were all ultimately successful. Could it have happened differently ? Not so sure.

BostonFern 7y ago
"Move fast and break things." I'm afraid getting there first is pretty much imperative.
- Loughla 7y ago
  Honestly, I don't understand why this site seems to hate Zoom so much. They're doing what all of the large players have done in the past. Why aren't they being congratulated for their success? This is not meant to be snarky. They are literally living by the move fast and break things motto. Growth at the expense of everything else to win the market first, fix it second. How are they not the golden child of SV right now?
  - jeltz 7y ago
    People hate those large players too. Just look at how much hate MongoDB got for ignoring both reliability and safety.
  - kkarakk 7y ago
    It's just 2020 speaking, people outraged on the behalf of users who honestly don't care and just want easy to use videochatting. This is just a symptom of ycombinator becoming a more widely known social network. All the malaises of social networks like pointless discussions about morality without any concrete solutions are coming along with that.
    - divbzero 7y ago
      > pointless discussions about morality without any concrete solutions The correct response to many moral issues is not to create concrete solutions, but simply to stop people from doing bad things.

Nullabillity 7y ago

"Oh no, it used to be alright that we are shady as hell, because, you see, we never thought anyone would actually use our service!" Give me a break..

jbverschoor 7y ago

What a load of crap... First, some background: our platform was built primarily for enterprise customers – large institutions with full IT support These new, mostly consumer use cases have helped us uncover unforeseen issues with our platform Never ever gonna use zoom.. I got rid of it a long time ago when I found out about the malware...

rado 7y ago

hc91 7y ago

Translation: "We are SO sorry that we got caught and that you feel this way about us. Let's see if we can react to this situation fast enough before everyone will start replacing us with alternatives that at least have a better reputation." ... yeah, give me a break!

seemslegit 7y ago

This is "we are sorry for getting caught" changes-nothing nonpology. The use of "end to end encryption" designation was no confusion, it was deception - it is implausible that this could have been done accidentally or as a result of a misunderstanding without engineers warning managers that this is not how zoom works and being overridden in their objections to communicate it as such. They also double down on data collection. Disclosure does not establish consent and "we do not sell data" is a red herring because data can still be shared with third parties for business purposes against the interests of the users without being overtly sold (not to mention with governments under various "compelled cooperation" arrangements) and the entire policy can be subject to retroactive change without recourse. The fact that they were targeting organizations with IT support is irrelevant except maybe to discredit the people within those organizations who greenlighted Zoom. The saddest part is that it is unlikely any of the competing corporate offers are any better in any of those respect, but then they are not being actively pumped these days.

jwr 7y ago
> This is "we are sorry for getting caught" changes-nothing nonpology. True, but I am still happy to see it. It shows that they got burned and that they noticed and felt the burn. It remains to be seen how they follow up — I will be watching closely.
- seemslegit 7y ago
  People who care and have the time to spare might, but this is standard PR crisis mitigation technique and the goal is to have a large mass of the users thinking "ah, this was just a mistake made under pressure in crazy times, zoom is ok now, still convenient".
oneVoiceOnHN 7y ago
They need to a better logo and a bigger advertising budget showing hip 20 year old dancing to indie music. It worked for i-nother company.

hc91 7y ago

I fully agree with everything you have said. I have made a similar comment and it got downvoted to hell. I do not understand HN anymore.

seemslegit 7y ago
This is because an increasingly large percentage of the people here have to deal with the dissonance of having to make their living in an industry and business culture that depends on those kind of practices and consequently rewards and promotes them.
- hc91 7y ago
  Possibly. Also looks like (almost) all the critical comments towards this article get magically downvoted - seriously check it out. Legit question - what happens when your karma gets to zero? Do you get banned?
  - bdefore 7y ago
    It is against HN community guidelines to comment about comment voting because it adds nothing substantial to the discussion.
    - seemslegit 7y ago
      > because it adds nothing substantial to the discussion. Substantial to whom ? Often people who downvote will prvoide additional information as to their reasoning which can be substantial or insubstantial like any other comment.
      - TeMPOraL 7y ago
        If a downvoter didn't share their reasoning already, it's unlikely they will be prompted by a general "why is this getting downvoted?" comment. That's why site rules say you should not ask about downvotes.

tyingq 7y ago

"Removed the attendee attention tracker feature." Oh, I missed that one. https://support.zoom.us/hc/en-us/articles/115000538083-Attendee-attention-tracking https://support.zoom.us/hc/en-us/articles/115000538083-Atten...

empressplay 7y ago

I know this is banal but fk these guys.

dang 7y ago
Please don't do this here. You may not owe "these guys" better, but you owe this community better if you're posting to it. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

pjfunk 7y ago

"We didn't design for for scaling overnight" is different from "we did care for security until we got caught" However small or big, a company shouldn't be selling data without user consent, shouldn't use terms end-to-end encryption while make otherwise claims. This behaviour should be punishable

piokoch 7y ago
Facebook did that (e.g. https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Analytica_data_scandal https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana..., funny stuff they did to circumvent GDPR). And Who cared? There was some noise in the media and that's all. Was Mark Zuckerberg punished? For me all this Zoom bashing looks a bit as if those guys stepped on someone's toe, who does not like the idea of having another competitor in the social media/online advertising area.

oliwarner 7y ago

Maaaan, the /wordpress/ in the URL really knocks home how slapdash this whole operation is. And this wasn't anything but an acknowledgement that they're not qualified to produce the software they're distributing. They still don't even know what they don't know.

justusthane 7y ago
What an odd thing to criticize them about. Privacy and security issues aside (which are serious), it seems to be an extremely well engineered product. They’ve handled the absolute explosion in users with nary a glitch, and in my experience it’s the _only_ video conferencing solution that “just works”. It’s obvious that there’s some pretty impressive engineering behind it. I’m not sure exactly what your critique about Wordpress is. Is it that they’re using Wordpress, like 30% of the other websites in the world? Or is it that they didn’t bother removing it from the URL? Start keeping an eye out for “/wp-content/“ in the path of images or downloads on websites. You’ll be amazed.
alexpetralia 7y ago
Do you really think they're not "qualified" to produce video conferencing software? Does that seem like a reasonable statement? I am genuinely curious if you think a public company with millions of users and fairly reliable quality is not "qualified" to deliver its own product.
- oliwarner 7y ago
  I'm genuinely curious if you think that company status, bank balance or number of users translates into software quality. I posit that Zoom has been right place, right price. Simple as that. The software is demonstrably hot trash. Not just at client endpoints but structurally.
  - detaro 7y ago
    Right place, right price, pretty-much flawlessly working video chats. The latter point is just as important (there's a bunch of free video chat products), and suggests it's not completely trash.

zxj930057911 7y ago

Yes

yalogin 7y ago

Through this I learnt, for the first time, that they also send data to Linkedin.

tonyaiken 7y ago
That’s a enterprise integration, you can view participants’ LinkedIn profile which is very helpful if implemented right. https://marketplace.zoom.us/apps/ex1KIG08R3-ctKCi65YePA https://marketplace.zoom.us/apps/ex1KIG08R3-ctKCi65YePA
- rjacksonm1 7y ago
  >With Zoom's LinkedIn Sales Navigator integration, you’ll build connections and instantly gain insights about your meeting participants. Sounds pretty creepy. I assume participants have to opt into this?
- yalogin 7y ago
  No they explicitly said Linkedin sales api.

tobr 7y ago

I struggle to understand why the sudden influx of new users would affect these security problems in any way. OK, more people are affected, but the problems are surely the same regardless of how many users they have. To me it just comes across as an attempt to deliberately confuse the issue.

organsnyder 7y ago
They address this specifically in the article: > Dedicated journalists and security researchers have also helped to identify pre-existing ones. Sure, you could translate that as "more eyeballs have uncovered our sloppy security" if you'd like, but it doesn't strike me as dishonest.
- jtdev 7y ago
  This is cunning PR diversionary bullshit.
  - edoceo 7y ago
    Not cunning; it's a low effort hand wave. The rest is true.
    - EForEndeavour 7y ago
      If a team of career PR folks meticulously iterating on the precise wording of this message to frame the narrative in their favour doesn't count as "cunning" to you, I don't know what would.
      - NateEag 7y ago
        I believe "cunning" is not about intent, but the action's effectiveness. As an attempt to mislead or imply that there are no problems here, this is pretty much a failure, and thus not at all cunning.
        7y ago

ken 7y ago

Zoom has had major security issues for years, and they've always brushed them off as not a big deal. This isn't an isolated incident. If their position is now that the Zoom software was designed for corporate users, e.g., that you're expected to only run it on your own VPN where you can guarantee there's no malicious network traffic, then it should have "NOT FOR CONSUMER USE" plastered all over it. To me, this reads exactly like "Lol user error", except there's no "M" to "RTF" that ever said, for example, that its local web server stayed running after uninstallation and could take control of your camera, or that "E2E" in the Zoom docs doesn't mean the same thing as it means to the rest of the industry. There's no responsibility being taken here. Taking responsibility would be "We fired all our 'security' people who told us we had best-of-breed security, and hired some actual security experts to re-architect our system to provide actual security for our users." What they did here is indistinguishable from "We're sorry we got caught!" except in verbosity.

zentiggr 7y ago
Maybe a blog post saying "Yes, we acknowledge that we deliberately ignored major portions of security practices and just did whatever got us market share fastest. We can't change the past, but we're going to clean house and do privacy and security for real from now on, and we hope you'll stick with us, or come back after we've fixed <pointing to all of this>."
- onli 7y ago
  That's pretty much what this blog post is, with just a little bit more PR speak. And I'm honestly surprised that it is not totally watered down, it's not just PR speak and user blaming, but makes some clear points. The base defense is bad - that it was for less users and contexts before changes nothing - but it at least includes the "we will focus on that now, honestly". That's not bad already.
  - shadowgovt 7y ago
    We could read the PR blurb from the company that engineered for security and privacy before getting features in place users wanted, but we can't. They're not making a blog post because they ran out of runway money, having failed to get a product in user's hands in time for anyone to care about their existence.

juliend2 7y ago

I don't know exactly what is the main security issue right now, but as I understand it, it's mostly related to this: https://www.bleepingcomputer.com/news/security/zoom-lets-attackers-steal-windows-credentials-run-programs-via-unc-links/ https://www.bleepingcomputer.com/news/security/zoom-lets-att... (on Windows). The windows changelog[1] doesn't talk about a version released on April 1st, like the press release says[2]. So is the only way to mitigate that issue for non-techie users is to deactivate the chat feature for all conversations? [1] https://support.zoom.us/hc/en-us/articles/201361953-New-Updates-for-Windows https://support.zoom.us/hc/en-us/articles/201361953-New-Upda... [2] https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-users/ https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u...

shadowgovt 7y ago

Zoom seems to be another example of the repeating pattern we seem to see from web service software: if the product has good UX, people don't care about the technical issues that aren't in their faces. At least, they don't care in any tangible way like "They stop using the product." Remember when Twitter was incredibly unstable? That was fine when it had only ten thousand users. They had to fix it fast when it had a million. But the thing is: that seems to be viable software practice (rush on features, forget about the robustness and the corner cases) because it keeps working.

yspeak 7y ago

I'm really not clear where such hostility in the comments is coming from towards a company that is offering free services during a worldwide pandemic albeit with a marketing upside. Sure there are issues but Zoom appears to be addressing them. Times like these expose or highlight vulnerabilities to fix and ultimately serve as an opportunity to make these services better. I assume good faith in the comments and that they are not competitors or security services advertising their chops.

Quanttek 7y ago

> "On March 29th, we updated our privacy policy to be more clear and transparent around what data we collect and how it is used – explicitly clarifying that we do not sell our users’ data, we have never sold user data in the past, and have no intention of selling users’ data going forward." That is such a dishonest way of framing it. No one was really concerned whether they would "sell" data. The issue was with the exorbitant amount of data they collect and its analysis for commercial purposes, be it ads (which doesn't involve selling data), targeted pricing or providing access to corporate admins.

amiga_500 7y ago
Surely as this comes from the FB lib zoom are not an outlier here? Why the sudden pearl clutching at zoom when everyone is using facebook, google and any other site that has facebook tracking built in?
- sitzkrieg 7y ago
  cant help but feel like hit squads from the lagging competition
  - amiga_500 7y ago
    I agree, this level of synthetic concern doesn't feel like "grass roots". MS did a terrible job with Skype and Lync. No doubt they were expecting to be able to bind it to exchange server and then create a coupling that embedded into an effective monopoly, creating yet another bad user experience that somehow becomes "the norm". Hopefully at some point MS will compete by improving their products and we will have a better WFH experience.
- AlexandrB 7y ago
  I work very hard to keep Facebook out of my life. I run an ad-blocker and I don't log into my (inert) Facebook account outside of privacy mode (or a VM). Unfortunately, I don't have a choice about using Zoom. So it sucks that I'm effectively getting backdoored with this nonsense. Why is it OK to expose my information to an advertising company like Facebook without asking for permission first? Because everyone else does it?

cmcd 7y ago

> "We want to start by apologizing for the confusion we have caused by incorrectly suggesting that Zoom meetings were capable of using end-to-end encryption. Zoom has always strived to use encryption to protect content in as many scenarios as possible, and in that spirit, we used the term end-to-end encryption." Excerpt from their previous release above, only a few hours earlier. Glad to hear they are starting to make improvements but waiting for public backlash to fix issues is a bad sign.

crazygringo 7y ago

Key section: > Over the next 90 days, we are committed to... Enacting a feature freeze, effectively immediately, and shifting all our engineering resources to focus on our biggest trust, safety, and privacy issues. I see a lot of comments here claiming that this blog post is bland corporate apologia, doesn't take responsibility, doesn't change anything. But this seems like a pretty legit turnaround. Overall, they seem to be addressing pretty much everything that's been brought up. They removed the Facebook SDK, they removed attention tracking, they've clarified their encryption policies in detail. One commenter here is asking for more, for punishment, another demands their security team be fired. And I mean, if someone wants to try to sue Zoom for misusing the term E2EE then go for it, but obviously Zoom can't "punish itself" in a blog post, and pinning it on a few bad engineers feels like a scapegoat. This seems to be positive steps, folks. Genuinely not sure what more you could be asking for from a regular for-profit business.

gizmo385 7y ago
> One commenter here is asking for more, for punishment, another demands their security team be fired. And I mean, if someone wants to try to sue Zoom for misusing the term E2EE then go for it, but obviously Zoom can't "punish itself" in a blog post, and pinning it on a few bad engineers feels like a scapegoat. A portion of the development community loves to talk about blameless post-mortems and a blame-free culture until a tech company like Zoom does something they don't like.
- tprynn 7y ago
  I think it's generally a poor assumption to assume that any two internet "crowds" are the same people. Some commenters care about X and some about Y and we can almost never tell what the overlap between those groups is. The hivemind is not as uniform as that.
  - jolmg 7y ago
    Well said, and it applies beyond just "internet" crowds. Some people think whole nationalities work as uniform hiveminds.

ivanfon 7y ago

Off topic, but it would be nice to mention Zoom in the title, it's pretty ambiguous otherwise

_pmf_ 7y ago

I find the whole ganging up against Zoom disgusting. Mac-fanbois-cum-security-experts blaming Zoom for the deficiencies of a) their platform not having a working native teleconferencing solution and b) their platforms arbitrary installer policies. Then there's the issue that Zoom is now suddenly responsible for the complete lack of security awareness of teachers and middle managers who have never before held online classes, and are publicly posting meeting credentials so that everyone can join. All, of course, while the while world is free loading (yes, "you are the product, hurr durr"; great contribution).

oandrei 7y ago

I want to share my solution for remote collaboration and teaching: https://github.com/amkhlv/mathpump3 https://github.com/amkhlv/mathpump3 Professor uses Wacom and Inkscape to draw a picture, which is incrementally transmitted to students' computers. Students, those who have Wacom, may interact. Or just watch. Transmission happens every time the svg file is saved. Transmission requires a RabbitMQ server, which can be easily set up. Basically, a class needs one person who knows Linux, to set up the server. It is intended for scientific collaboration or teaching in small groups of people. I am now using it for teaching my QFT class, although it only has 5 students. In principle, it should scale, but I have not tried it for large groups... Drawing with Wacom in Inkscape is a pleasure, once you get used to it. In some sense, it is more convenient than using a physical blackboard. Although, some training is needed...

soared 7y ago
Awesome idea! Is there much overlap in the area where a professor has a wacom and also has a student that knows linux?

deleted 7y ago

[deleted]

Dowwie 7y ago

I think we need to acknowledge the fact that Zoom, and its use of cloud infra, took on 20x peak volume of 2019 within just a few months.

lxe 7y ago

> On March 27th, we took action to remove the Facebook SDK in our iOS client and have reconfigured it to prevent it from collecting unnecessary device information from our users. Sounds like folks at Zoom take privacy and security related feedback pretty seriously.

Nevada-Smith 7y ago

"Thousands of enterprises around the world have done exhaustive security reviews of our user, network, and data center layers and confidently selected Zoom for complete deployment." Interesting that he would point out the failure of thousands of IT departments around the world.

rchaud 7y ago
that jumped out to me as well. I'm in a large org that uses Zoom, not company-wide, but certainly in several departments. We have a SaaS questionnaire that vendors need to submit for review as part of the procurement process. With everything that's come out since (not just the iOS client issue), I'm wondering how deep that questionnaire goes with regards to security concerns.

jefftk 7y ago

While I think Zoom has a lot of work to do from a security perspective, overall I think we should be supportive: facilitating -- mostly for free! -- very low friction video calls between an enormous number of isolated people is an incredible service.

jasonv 7y ago

I think this is a necessary move on their part. And they obviously have the business and engineering talent to make a good product (it's better than their competition, I'll grant). But how much of their market share came because of some nefarious business and technical practices? Forgive and forget, 'cause "correction"?

kmtrowbr 7y ago

December 2019: 10M daily participants. March 2020: 200M daily participants. A sustained 20x spike in usage. And it’s still working! I think that’s amazing. Think through this situation — 90,000 schools suddenly using Zoom, children doing their classes. What is most important: option 1) it just works option 2) it’s 100% secure Imagine you were a member of Zoom's team, would you not be justified in feeling proud right now?

enriquto 7y ago
> Imagine you were a member of Zoom's team, would you not be justified in feeling proud right now? It has nothing to do with scaling. The problem is the numerous anti-privacy and anti-safety measures that they actively partook in. Those were no "features missed out" due to rapid development. Those were anti-user features purposefully developed in. This is what people are complaining about; and this is what the zoom manifesto is shamefully trying to brush off as if they were related to rapid development or to rapid scaling. If I was a member of the zoom team (who hadn't actively participated in these features), I would be extremely ashamed of my company for spoiling our success with these damaging practices.
- kmtrowbr 7y ago
  I have to believe the aim of these features was to make it easier for Zoom to be installed and to "just work." I'm inclined to give them the benefit of a doubt right now.

tibiahurried 7y ago

I am sorry, but it is too late. Zoom should have valued more their user's privacy. They clearly didn't and now they are trying to fix it. Too late. Trust is really hard to gain, and once you lose it you are done. As Marc Benioff often says: Trust is the one most important value.

xenocyon 7y ago

I'm pretty new to Zoom. It always seems to take me a while to get to the option of using the web browser instead of the executable. Is there an easy way (e.g. URL structure) to force the web-browser-meeting and skip the download dialog?

xenocyon 7y ago
Answering my own question: the URL to use to force using the web browser instead of the download is: http://zoom.us/wc/join/{your-meeting-id} http://zoom.us/wc/join/{your-meeting-id}

talkingtab 7y ago

Zoom added the Facebook SDK. When they got caught they removed it. Great! But what about a statement that they will provide a user-focused third-party security assessment on a regular basis so that users know there are no other issues? People need transparency.

hyko 7y ago

“It takes 20 years to build a reputation and five minutes to ruin it” -Warren Buffet They didn’t even bother to build up a reputation; hard to see how they’re going to build respect for people’s privacy and security into their culture now.

whatok 7y ago

For anyone excusing any of this, Zoom is currently a 34bn dollar company. There really are no "whoops, didn't expect to get this popular" excuses that are legitimate for all of these issues; especially when none of these things have to do with scaling and are instead just boneheaded design decisions.

Waterluvian 7y ago
"34 billion" is the fake Silicon Valley price tag. And they get there by rushing like a bunch of idiots to a hollow Hoover Dam of a product that looks great to everyone from the outside.
- whatok 7y ago
  Zoom is a public company. The CEO owns 4% of it.