9 ms·

Seriously, all people who are surprised about this type of news should really understand that most "successful" (as in, popular) tech/.com/SV "startups" these d

Seriously, all people who are surprised about this type of news should really understand that most "successful" (as in, popular) tech/.com/SV "startups" these days are like this. If you "waste" time on the real important stuff such as a good design, user security, or the like, you will lose over to a competitor who didn't and therefore was able to spend more time on marketing. If you waste your time on user privacy you will be totally crushed by that competitor whose definition of "privacy" was "how much can I pester this user until he gives me access to his address book so I can spam his friends?". I don't think this is good. I think this is very sad. But it is what it is. I still remember the Whatsapp founders coming into the jabber mailing lists with "please let me configure my server"-type questions, for god's sake.

herodotus 7y ago
Agree, but I want to add something: the usability of Zoom is good, even for casual computer users. Strategically, they focussed on what they considered to be the things that would give them sales. Not saying it is good, but it certainly worked for them (at least until now).
- sdoering 7y ago
  I agree. My SO ist currently studying from home due to the pandemic. A lot of professors and tutors use what they find first. There is no standard. She already had to use MS Teams, Slack, Jitsu and Zoom. Her take was that Zoom was by far the most usable tool. And most of her 20 years younger co-students agree. Sadly most people don't even know about the problematic status of Zoom. And if one tells them, most do not understand what's so problematic about that.
  - fossuser 7y ago
    Partly because it isn't really problematic for students and teachers that are trying to use VTC. When the alternatives don't work, it doesn't really matter how secure the alternatives are.
  - sneak 7y ago
    The students are all forced to agree to these abusive third party TOS simply to receive the education to which they are entitled/for which they have already paid. That’s a bait and switch on the part of the university. “You’ve already paid, but now you have to give up your civil rights against this third party you’ve never heard of to get the service.” There should be liability for the schools for doing this. A class action, perhaps?
    - riquito 7y ago
      There's a pandemic, schools and professors try what they can to keep the courses running and not ruin their students' year, and your reaction is "sue them"?
      - sneak 7y ago
        They’re pulling a bait and switch. There are video technologies they can license so that they can keep things running without forcing students into having to enter into abusive third party agreements. They can hire people to set up simple first-party HLS streaming systems—it can be done in a day. There are tons of non-abusive alternatives. Zoom makes malware. Can you imagine being given the option by a university to whom you have already paid tens of thousands of dollars: “install this malware or you don’t get to come to class”? You could say the same about Amazon and their backlash against workers. “There’s a pandemic, and this company is doing what it can to keep the supplies moving, and your reaction is “sue them”?” Yes, that is the appropriate reaction if they break the law. A pandemic does not justify abusive, coercive behavior. If anything, it makes it more abusive.
      - izacus 7y ago
        Pandemic really shouldn't be an excuse to just sell out students to any party that used more marketing money. There's a reason why (at least in this part of the world) the educational products receive additional scrutiny and need to comply to additional privacy and security directives.
restingrobot 7y ago
This is a bad point. The difference between using AES-128 and AES-256 from a code standpoint is trivial. The only explanation for this is either gross incompetence or malevolence. Personally I don't use Zoom, nor would I recommend its use for even personal conversation.
- dpeck 7y ago
  the difference is a copy and paste from an older StackOverflow post.
  - restingrobot 7y ago
    Using code without understanding its implications would fall in the gross incompetence category.
    - AshamedCaptain 7y ago
      And my point is that this happens all the time. Natural selection seems to favor the type of company that would just copy&paste from SO (then spend their resources on some fancy viral marketing) instead of the one that would stop to think about it.
      - catalogia 7y ago
        People shouldn't be surprised, but they should be upset.
    - Igelau 7y ago
      Awfully big talk on a Friday!
- lukeschlather 7y ago
  Have you studied the performance implications of different key sizes on real-time video applications? A little bit of reading suggests AES-256 carries a significant performance penalty vs. AES-128. I would be keen to hear from someone who has tried it in real-world situations and can demonstrate AES-256 working well on e.g. low-end android devices/cheap laptops without issue. I use Zoom regularly. Their video works well. I would like to have AES-256 but also I suspect this is not a casual choice, and I'm not sure it's as clear-cut as you're assuming.
etaioinshrdlu 7y ago
More generally, there is a culture of celebrating rule-breaking or even law breaking within the startup community. As long as you get away with it, and make money off it, then it's totally cool...
- philwelch 7y ago
  That’s also partially a reaction to so many rules and laws being utterly counterproductive and/or corrupt. Respect for rules and regulations depends on those rules and regulations having respectable motivations and effects in the first place.
  - etaioinshrdlu 7y ago
    It does lead to a general sense of degrading lawlessness throughout society. When powerful people start to have contempt for laws it can get really abusive.
    - philwelch 7y ago
      Sure. But at this point everyone picks and chooses which laws they care about. I've observed a pretty heavy overlap between people who care a great deal about taxi regulations (most of which exist merely to artificially prop up rent-seeking owners of taxi medallions) and people who consider American immigration law so fundamentally unjust that it should simply not be enforced anymore. Faithfully Obeying All The Rules And Regulations isn't an especially popular ideology, and if you consistently advocate it, you'll end up very unpopular with everyone.
      - etaioinshrdlu 7y ago
        Immigration is a tough issue. The debate is now mostly focused on what to do with undocumented immigrants who are already here, perhaps with families, etc. That's one issue which has been debated to death. But there are also perhaps hundreds of millions of potential immigrants worldwide who would love to come to the US permanently and have the means to do so, if it were legal. But they cannot get a green card or h1b because those are nearly impossible to get from people in some counties. So they never come. It does seem hard to decide a fair system here but any decision is just that... A system of laws... They have no meaning unless followed. What's the point of rule of law anyways? It's the answer to arbitrary rule: by monarchs and dictators.
WalterBright 7y ago
I more suspect it is a problem stemming from hiring people who are all new to professional programming. Avoiding these issues means hiring some older, experienced professionals.
- api 7y ago
  Those cost more.
  - WalterBright 7y ago
    Much cheaper than trying to put out the fires caused by not using them. Experience costs more because it pays off.
    - ComputerGuru 7y ago
      Yes, but people are short sighted. They also probably think “I’d rather grow quickly and be able to afford this down the line than do it right and risk missing out.”
      - WalterBright 7y ago
        > Yes, but people are short sighted. Which comes from being inexperienced as well. And an experienced hand can save you money immediately. Such as selecting a more appropriate programming language to implement the project in. Suggesting an appropriate library to use rather than rolling one's own. Avoiding multithreaded coding disasters. Having a backup system that works. Having a revision control system that works. Knowing that unit tests have an immediate payoff. Avoiding stupid metrics like paying people based on lines of code written. Avoiding rolling your own encryption. Don't transmit passwords in plaintext. Don't do illegal things. Don't leave yourself wide open to lawsuits. Use a real CPA to do your taxes. Keep proper business records so the IRS doesn't hang you. And on and on. My CPA makes lots of money when some young entrepreneur comes in all terrified that the IRS is auditing him and he kept no records and didn't even file returns. An experienced hand will tell you to never ignore and never mess with the tax man. Check out what happened to Will Smith when he paid no attention to the IRS. All his proceeds from "Fresh Prince of Bel Air" went to the IRS as taxes, interest, and penalties.
jonmartinwest 7y ago
I think you might be missing the bigger picture. You have a company that the "Ministry of State Security of the People's Republic of China" can easily hack to spy on American children and businesses. What could go wrong?
- reaperducer 7y ago
  Not just American. Someone posted a screenshot on HN yesterday or the day before of the prime minister of the United Kingdom having a video chat with about 16 other top government officials over Zoom. Anyone want to wager how many of their computers are now p0wned.cn?
munk-a 7y ago
I agree this isn't uncommon, but that does nothing to make it acceptable. Bad security design is unacceptable and this is sort of indicative of a large dissonance when it comes to SV startups. "Disruption" isn't ignoring requirements - if you are able to under price your competitors because you fail to adhere to good practices (or, more importantly, regulations[1]) you're not building a lean and useful product - you've just built a half-assed competitor that can undercut prices because it is incomplete... You're selling something as a competing solution when it only does half the stuff. There is a lot of good to be said about identifying the 90/10 value components of a problem space and discarding expensive features that would just add complexity for little value - but if those features are requirements you're just failing to actually meet the points consumers (or markets ala regulations) expect and making your profit off of deceit. 1. Looking at you Uber.
- josho 7y ago
  But, the parent's point is that it is acceptable. Zoom has become a $300mm company all the while flatly lying (or being very generous in statements). What is the consequence for them? They made rapid market growth because they didn't waste constrained resources on security/privacy concerns. No consequences means their behavior is acceptable. Which means this will repeat until there is a reason that makes this behaviour not acceptable.
dhosek 7y ago
But when I see "roll their own encryption," it tells me that they went out of their way to create something subpar. There are some things that one should never* roll one's own of, and encryption has to be the top of the list. * OK, if you're an encryption expert, you obviously would roll your own to advance the state of the art, but Zoom are quite obviously not encryption experts.
- Justsignedup 7y ago
  "Roll your own" is such a oversimplification. Usually it is: I can spend all this time making things right, or bob here knows how to do this other simple way that is good enough in a week.
  - uoaei 7y ago
    It's so much more important to make things right than to have something "good enough" (which is never actually good enough) that reducing it to that simplistic binary is not all that drastic.
Justsignedup 7y ago
It is easier for Zoom to apologize and fix than for zoom to have no customers but a solid stack.

herodotus 7y ago

Agree, but I want to add something: the usability of Zoom is good, even for casual computer users. Strategically, they focussed on what they considered to be the things that would give them sales. Not saying it is good, but it certainly worked for them (at least until now).

sdoering 7y ago
I agree. My SO ist currently studying from home due to the pandemic. A lot of professors and tutors use what they find first. There is no standard. She already had to use MS Teams, Slack, Jitsu and Zoom. Her take was that Zoom was by far the most usable tool. And most of her 20 years younger co-students agree. Sadly most people don't even know about the problematic status of Zoom. And if one tells them, most do not understand what's so problematic about that.
- fossuser 7y ago
  Partly because it isn't really problematic for students and teachers that are trying to use VTC. When the alternatives don't work, it doesn't really matter how secure the alternatives are.
- sneak 7y ago
  The students are all forced to agree to these abusive third party TOS simply to receive the education to which they are entitled/for which they have already paid. That’s a bait and switch on the part of the university. “You’ve already paid, but now you have to give up your civil rights against this third party you’ve never heard of to get the service.” There should be liability for the schools for doing this. A class action, perhaps?
  - riquito 7y ago
    There's a pandemic, schools and professors try what they can to keep the courses running and not ruin their students' year, and your reaction is "sue them"?
    - sneak 7y ago
      They’re pulling a bait and switch. There are video technologies they can license so that they can keep things running without forcing students into having to enter into abusive third party agreements. They can hire people to set up simple first-party HLS streaming systems—it can be done in a day. There are tons of non-abusive alternatives. Zoom makes malware. Can you imagine being given the option by a university to whom you have already paid tens of thousands of dollars: “install this malware or you don’t get to come to class”? You could say the same about Amazon and their backlash against workers. “There’s a pandemic, and this company is doing what it can to keep the supplies moving, and your reaction is “sue them”?” Yes, that is the appropriate reaction if they break the law. A pandemic does not justify abusive, coercive behavior. If anything, it makes it more abusive.
    - izacus 7y ago
      Pandemic really shouldn't be an excuse to just sell out students to any party that used more marketing money. There's a reason why (at least in this part of the world) the educational products receive additional scrutiny and need to comply to additional privacy and security directives.

restingrobot 7y ago

This is a bad point. The difference between using AES-128 and AES-256 from a code standpoint is trivial. The only explanation for this is either gross incompetence or malevolence. Personally I don't use Zoom, nor would I recommend its use for even personal conversation.

dpeck 7y ago
the difference is a copy and paste from an older StackOverflow post.
- restingrobot 7y ago
  Using code without understanding its implications would fall in the gross incompetence category.
  - AshamedCaptain 7y ago
    And my point is that this happens all the time. Natural selection seems to favor the type of company that would just copy&paste from SO (then spend their resources on some fancy viral marketing) instead of the one that would stop to think about it.
    - catalogia 7y ago
      People shouldn't be surprised, but they should be upset.
  - Igelau 7y ago
    Awfully big talk on a Friday!
lukeschlather 7y ago
Have you studied the performance implications of different key sizes on real-time video applications? A little bit of reading suggests AES-256 carries a significant performance penalty vs. AES-128. I would be keen to hear from someone who has tried it in real-world situations and can demonstrate AES-256 working well on e.g. low-end android devices/cheap laptops without issue. I use Zoom regularly. Their video works well. I would like to have AES-256 but also I suspect this is not a casual choice, and I'm not sure it's as clear-cut as you're assuming.

etaioinshrdlu 7y ago

More generally, there is a culture of celebrating rule-breaking or even law breaking within the startup community. As long as you get away with it, and make money off it, then it's totally cool...

philwelch 7y ago
That’s also partially a reaction to so many rules and laws being utterly counterproductive and/or corrupt. Respect for rules and regulations depends on those rules and regulations having respectable motivations and effects in the first place.
- etaioinshrdlu 7y ago
  It does lead to a general sense of degrading lawlessness throughout society. When powerful people start to have contempt for laws it can get really abusive.
  - philwelch 7y ago
    Sure. But at this point everyone picks and chooses which laws they care about. I've observed a pretty heavy overlap between people who care a great deal about taxi regulations (most of which exist merely to artificially prop up rent-seeking owners of taxi medallions) and people who consider American immigration law so fundamentally unjust that it should simply not be enforced anymore. Faithfully Obeying All The Rules And Regulations isn't an especially popular ideology, and if you consistently advocate it, you'll end up very unpopular with everyone.
    - etaioinshrdlu 7y ago
      Immigration is a tough issue. The debate is now mostly focused on what to do with undocumented immigrants who are already here, perhaps with families, etc. That's one issue which has been debated to death. But there are also perhaps hundreds of millions of potential immigrants worldwide who would love to come to the US permanently and have the means to do so, if it were legal. But they cannot get a green card or h1b because those are nearly impossible to get from people in some counties. So they never come. It does seem hard to decide a fair system here but any decision is just that... A system of laws... They have no meaning unless followed. What's the point of rule of law anyways? It's the answer to arbitrary rule: by monarchs and dictators.

WalterBright 7y ago

I more suspect it is a problem stemming from hiring people who are all new to professional programming. Avoiding these issues means hiring some older, experienced professionals.

api 7y ago
Those cost more.
- WalterBright 7y ago
  Much cheaper than trying to put out the fires caused by not using them. Experience costs more because it pays off.
  - ComputerGuru 7y ago
    Yes, but people are short sighted. They also probably think “I’d rather grow quickly and be able to afford this down the line than do it right and risk missing out.”
    - WalterBright 7y ago
      > Yes, but people are short sighted. Which comes from being inexperienced as well. And an experienced hand can save you money immediately. Such as selecting a more appropriate programming language to implement the project in. Suggesting an appropriate library to use rather than rolling one's own. Avoiding multithreaded coding disasters. Having a backup system that works. Having a revision control system that works. Knowing that unit tests have an immediate payoff. Avoiding stupid metrics like paying people based on lines of code written. Avoiding rolling your own encryption. Don't transmit passwords in plaintext. Don't do illegal things. Don't leave yourself wide open to lawsuits. Use a real CPA to do your taxes. Keep proper business records so the IRS doesn't hang you. And on and on. My CPA makes lots of money when some young entrepreneur comes in all terrified that the IRS is auditing him and he kept no records and didn't even file returns. An experienced hand will tell you to never ignore and never mess with the tax man. Check out what happened to Will Smith when he paid no attention to the IRS. All his proceeds from "Fresh Prince of Bel Air" went to the IRS as taxes, interest, and penalties.

jonmartinwest 7y ago

I think you might be missing the bigger picture. You have a company that the "Ministry of State Security of the People's Republic of China" can easily hack to spy on American children and businesses. What could go wrong?

reaperducer 7y ago
Not just American. Someone posted a screenshot on HN yesterday or the day before of the prime minister of the United Kingdom having a video chat with about 16 other top government officials over Zoom. Anyone want to wager how many of their computers are now p0wned.cn?

munk-a 7y ago

I agree this isn't uncommon, but that does nothing to make it acceptable. Bad security design is unacceptable and this is sort of indicative of a large dissonance when it comes to SV startups. "Disruption" isn't ignoring requirements - if you are able to under price your competitors because you fail to adhere to good practices (or, more importantly, regulations[1]) you're not building a lean and useful product - you've just built a half-assed competitor that can undercut prices because it is incomplete... You're selling something as a competing solution when it only does half the stuff. There is a lot of good to be said about identifying the 90/10 value components of a problem space and discarding expensive features that would just add complexity for little value - but if those features are requirements you're just failing to actually meet the points consumers (or markets ala regulations) expect and making your profit off of deceit. 1. Looking at you Uber.

josho 7y ago
But, the parent's point is that it is acceptable. Zoom has become a $300mm company all the while flatly lying (or being very generous in statements). What is the consequence for them? They made rapid market growth because they didn't waste constrained resources on security/privacy concerns. No consequences means their behavior is acceptable. Which means this will repeat until there is a reason that makes this behaviour not acceptable.

dhosek 7y ago

But when I see "roll their own encryption," it tells me that they went out of their way to create something subpar. There are some things that one should never* roll one's own of, and encryption has to be the top of the list. * OK, if you're an encryption expert, you obviously would roll your own to advance the state of the art, but Zoom are quite obviously not encryption experts.

Justsignedup 7y ago
"Roll your own" is such a oversimplification. Usually it is: I can spend all this time making things right, or bob here knows how to do this other simple way that is good enough in a week.
- uoaei 7y ago
  It's so much more important to make things right than to have something "good enough" (which is never actually good enough) that reducing it to that simplistic binary is not all that drastic.

Justsignedup 7y ago

It is easier for Zoom to apologize and fix than for zoom to have no customers but a solid stack.