4 ms·

you're obviously not worried about traffic routed through China might cause IP theft? And you also say Zoom for a lot of cases is fine. Would you say if my comp

you're obviously not worried about traffic routed through China might cause IP theft? And you also say Zoom for a lot of cases is fine. Would you say if my company does work for clients in critical technologies (energy plants, telecoms) where research is an expensive upfront investment that it's OK to use Zoom? Or is it more for companies who are only running a web-dev SaaS product where nobody cares about stealing it? I'm asking as somebody who has found his code stolen by a Chinese colleague working from our Hangzhou office and then published on github after he switched to Huawei (under his real name because that's the amount of f*s they give). Seriously please don't assume your threat models are portable.

PeterStuer 7y ago
If you are worried about traffic routed through China might cause IP theft, are you also worried about traffic routed through Five Eyes countries (US, UK, Canada, Australia and New Zealand)? After all, they have been caught red handed using their communications interception intelligence gathering for economic favoring of their own companies.
- DyslexicAtheist 7y ago
  > If you are worried about traffic routed through China might cause IP theft, are you also worried about traffic routed through Five Eyes countries (US, UK, Canada, Australia and New Zealand)? very much so. if you work on projects that take a 2-3 years forward investment on research and based in central Europe (automotive, telecoms, energy) the idea of hosting your source code on github or using google cloud for critical core services is totally out of the question. Some of my clients even booted Atlassin out of their portfolio because Jira was considered a security risk after Australia changed it's laws last year. If you're building web-tech maybe this is fine but that doesn't mean your threat-models are portable to other domains.
signal11 7y ago
> you're obviously not worried about traffic routed through China might cause IP theft? Newer versions of Zoom allow you to specify which countries’ data centres are allowed to host your meeting, and also shows which data centres are in use. They’ve also cleaned up their act on encryption. But yes, a lot of Zoom development occurs in China (700+ employees). But it is US owned. Many other corporations also develop software in China, so I have to ask — where’s the evidence that using Zoom makes you especially vulnerable to being ripped off? Because otherwise it seems a bit FUD-ish.
- DyslexicAtheist 7y ago
  trust only works in retrospect. Zoom has done nothing in its past to deserve that trust. If one can live with a software that behaves like malware (disabling of a hosts security controls and fake claims about e2ee) than nothing can convince them. Chances are they've committed to Zoom long before and it's now impossible to walk them back to a different reasoning. It's like arguing with a QAnon supporter about reality (Impossible). Also it's much easier to convince somebody to use product than it's to get them to stop using it. The latter has a cost (pride) but the former is free.
  - ftbai 7y ago
    > trust only works in retrospect. Seems somewhat odd to abide by this kind of principle instead of considering the real changes which we believe have been made, as Zoom seems to have cleaned up their act to some degree in response to the backlash, though you might think not enough. In any case, if you're being watched, you're not likely to cut corners, and Zoom is being watched. I'm not surprised if the 'suspicious public' effect averages out over all cases to account for the chance that a company is still keeping some unsavory practices under the covers.
  - Jonnax 7y ago
    https://www.theregister.co.uk/2017/01/23/webex_hid_url_for_remote_command_execution/ https://www.theregister.co.uk/2017/01/23/webex_hid_url_for_r... Cisco WebEx, secret backdoor that allows websites to run arbitrary code on your machine back in 2017. Are you going to use it again?
    - DyslexicAtheist 7y ago
      again? who said I ever used it? webex was already rubbish in 2012. the only reason webex is still being cited in 2020 in a whataboutist manner is that there are at least 75K internal CISCO employees forced to continue useing it on a daily basis.

PeterStuer 7y ago

If you are worried about traffic routed through China might cause IP theft, are you also worried about traffic routed through Five Eyes countries (US, UK, Canada, Australia and New Zealand)? After all, they have been caught red handed using their communications interception intelligence gathering for economic favoring of their own companies.

DyslexicAtheist 7y ago
> If you are worried about traffic routed through China might cause IP theft, are you also worried about traffic routed through Five Eyes countries (US, UK, Canada, Australia and New Zealand)? very much so. if you work on projects that take a 2-3 years forward investment on research and based in central Europe (automotive, telecoms, energy) the idea of hosting your source code on github or using google cloud for critical core services is totally out of the question. Some of my clients even booted Atlassin out of their portfolio because Jira was considered a security risk after Australia changed it's laws last year. If you're building web-tech maybe this is fine but that doesn't mean your threat-models are portable to other domains.

signal11 7y ago

> you're obviously not worried about traffic routed through China might cause IP theft? Newer versions of Zoom allow you to specify which countries’ data centres are allowed to host your meeting, and also shows which data centres are in use. They’ve also cleaned up their act on encryption. But yes, a lot of Zoom development occurs in China (700+ employees). But it is US owned. Many other corporations also develop software in China, so I have to ask — where’s the evidence that using Zoom makes you especially vulnerable to being ripped off? Because otherwise it seems a bit FUD-ish.

DyslexicAtheist 7y ago
trust only works in retrospect. Zoom has done nothing in its past to deserve that trust. If one can live with a software that behaves like malware (disabling of a hosts security controls and fake claims about e2ee) than nothing can convince them. Chances are they've committed to Zoom long before and it's now impossible to walk them back to a different reasoning. It's like arguing with a QAnon supporter about reality (Impossible). Also it's much easier to convince somebody to use product than it's to get them to stop using it. The latter has a cost (pride) but the former is free.
- ftbai 7y ago
  > trust only works in retrospect. Seems somewhat odd to abide by this kind of principle instead of considering the real changes which we believe have been made, as Zoom seems to have cleaned up their act to some degree in response to the backlash, though you might think not enough. In any case, if you're being watched, you're not likely to cut corners, and Zoom is being watched. I'm not surprised if the 'suspicious public' effect averages out over all cases to account for the chance that a company is still keeping some unsavory practices under the covers.
- Jonnax 7y ago
  https://www.theregister.co.uk/2017/01/23/webex_hid_url_for_remote_command_execution/ https://www.theregister.co.uk/2017/01/23/webex_hid_url_for_r... Cisco WebEx, secret backdoor that allows websites to run arbitrary code on your machine back in 2017. Are you going to use it again?
  - DyslexicAtheist 7y ago
    again? who said I ever used it? webex was already rubbish in 2012. the only reason webex is still being cited in 2020 in a whataboutist manner is that there are at least 75K internal CISCO employees forced to continue useing it on a daily basis.