6 ms·

It seems that we live in an era where if you made bad decisions in the past, you can never be trusted to make good decisions ever again. Even if you own your ba

It seems that we live in an era where if you made bad decisions in the past, you can never be trusted to make good decisions ever again. Even if you own your bad decisions and show lots of improvement. Nope. Once a pariah, always a pariah.

smacktoward 6y ago
Tell that to Microsoft.
lmm 6y ago
Zoom's decisions did not feel like mistakes so much as an expression of their values. The company repeatedly prioritised ease of use while doing the absolute minimum on the security front. Are there any grounds to believe that that calculus has changed?
- brians 6y ago
  No, but now they see that the minimum is not where they had thought. As someone who does security professionally, of course a business wants to do the minimum necessary for security. The point of security systems is to break things that would otherwise work. TLS is there to break sessions that would work under TCP. GPG is there to tell you to discard some mail.
- jariel 6y ago
  This is a good point. But I do think that company values do change. Zoom is getting the shining light of attention globally. Even human beings, in these situations, start to act more conscientiously, and then believe their own morality after the fact! I believe the keybase acquisition demonstrates this a bit - because they will get zero public goodwill from this - nobody on Main St. knows are cares what Keybase is, this won't be on CNN so they are probably very much trying to make things better. Owners of the company want money - now they are popular, they have to behave well to get that money. Wanting money usually transcends everything else including loyalty to state. A Chinese CEO with a popular Western product is going to realize that if his customers are way for CCP grabbing their data, it's a problem to his business. He doesn't want CCP snooping and one of the better ways to do that is to have better encryption as well. Doing slightly suspicious things doesn't matter if nobody is watching and therefore nobody cares, now that people care ... it matters. Just as a matter of pragmatism.
  - motivic 6y ago
    The CEO of Zoom is a naturalized U.S. citizen. He is ethnically Chinese but by all means he is no longer legally a Chinese citizen. Source: https://en.wikipedia.org/wiki/Eric_Yuan https://en.wikipedia.org/wiki/Eric_Yuan
- ViViDboarder 6y ago
  The fact that they hired Alex Stamos and probably just spent a bunch of money on buying Keybase seem like a sign that things are changing. They prioritized ease of use above all to get adoption before. This is appalling to me, but I believe they are seeing enough pressure to change course. It’s believable to me that they would intend to as they have already captured much of the consumer (non-B2B) market mind share and can afford to invest in this area. Will I be using it now? Still a no. Maybe I’m time though.
  - purple-dragon 6y ago
    > The fact that they hired Alex Stamos and ... Call my cynical, but "hiring" a bunch of infosec celebrities and critics as part-time consultants or contractors should be considered nothing but a (brilliant and silencing) PR move until the day that product updates and analyses reveal otherwise.
    - djrogers 6y ago
      > until the day that product updates and analyses reveal otherwise. The product (and their poor installer practice) has been updated several times in the past few months alone, and each move has made Zoom a more secure product, with the vast majority of the hubbub having been addressed. So are you simply ignoring that, or are you setting your own personal goalposts?
      - purple-dragon 6y ago
        I'm doing neither. I'm pointing out a logical fallacy in the parent comment. Hiring people part-time and buying a company does not, on its own, convey anything about improvements to product quality, security, or the corporate culture of either. I can only infer from your comment that you might think I have some beef or issue with Zoom. I said no such thing.
        wutbrodo 6y ago
        Sure, but it's not "on its own", it's in the context of the investment in security mentioned by the parent comment.
- Igelau 6y ago
  > did not feel like mistakes so much as an expression of their values That's an intepretation you're choosing to make.
  - albedoa 6y ago
    Calling it an interpretation is nothing short of revisionism. Nobody considers the hidden web server to have been an oversight. It required forethought and effort. It's not as if they didn't know what they were doing.
- damanamathos 6y ago
  You're absolutely right that past decisions focused on ease-of-use over security. For evidence that they've changed their focus you can see their April 1 blog post[1] and the weekly video AMAs they do that are summarised in their "90-Day Security Plan Progress Report" blog posts.[2] They're making a lot of progress. The Keybase acquisition is about building out a strong security team that will help them implement end-to-end encryption in 1,000 person meetings, which currently isn't possible anywhere.[3] [1] https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-users/ https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... [2] https://blog.zoom.us/wordpress/category/announcements/ https://blog.zoom.us/wordpress/category/announcements/ [3] https://twitter.com/alexstamos/status/1258405729720918016 https://twitter.com/alexstamos/status/1258405729720918016
netheril96 6y ago
Zoom is only a pariah on Hacker News.
- fernandotakai 6y ago
  microsoft too. people here still talk about "Embrace, extend, and extinguish" every time there's any good microsoft news.
  - somebodyiknew 6y ago
    It's far easier falling back on tired memes and muscle memory, than rewiring biases.
    - xref 6y ago
      Muscle memory exists for a reason. “Stove is hot, be careful before touching it.” “Microsoft sexually discriminated in executive hires because ‘women will get pregnant and quit’, stifled completion in multiple categories, expected free overtime or you’d be stack-ranked out of a job. Be careful before trusting.”
- detaro 6y ago
  I have heard from multiple friends that their employers banned Zoom after the negative press. And that's quite a few non-tech companies too.
- Kihashi 6y ago
  About half of my employer's clients (in manufacturing) have banned use of zoom and block it at the firewall.
CivBase 6y ago
I agree that there should be opportunity for individuals to learn from mistakes and improve. People can be stubborn and slow to change, but they should be given a chance. It seems reasonable that the same courtesy should be extended to organizations. However, organizations are an order of magnitude slower to change than individuals. Ultimately, an organization's policies are a reflection of the policies of its leaders. The bigger the organization, the more leaders have to change before the organization itself can truly change. It's much more likely that those who change just move on to another organization instead. Besides, the end-to-end encryption incident wasn't a "mistake". Zoom's response was to say that their definition of end-to-end was just different from everyone else's. They clearly knew exactly what they were doing. Zoom can change, but given their size and past I want more than a corporate apology and pinky swear before I trust them. They are making plenty of money and aren't going anywhere. There's plenty of time for them to earn my trust. However, they haven't yet earned enough of my trust to make me comfortable with this acquisition.
m3kw9 6y ago
Really? Why is everyone using FB, google?
- ta17711771 6y ago
  Why is everyone using sugar and heroin?
Aeolun 6y ago
> It seems that we live in an era where if you made bad decisions in the past, you can never be trusted to make good decisions ever again. Even if you own your bad decisions and show lots of improvement. I've seen this turn out for the best literally one time, and that was Microsoft. All the other times the bad company just continues its horrible slide into madness. It doesn't die either, just silently keeps churning out billions of dollars of shareholder value.
- yarrel 6y ago
  Microsoft isn't turning out for the best, though. They are just very good at putting a dusting of Open Source sugar on things.
  - Aeolun 6y ago
    However you call it, they’re producing value for me instead of (or in addition to) their shareholders.
- MattGaiser 6y ago
  You see Microsoft’s mediocre reliability making its way into GitHub. Has MSFT changed or are things breaking on the web just more accepted than your desktop?
sb057 6y ago
Organizations are not people. It is very straightforward for an individual to change their ways from bad to good. We should have mutual empathy and forgiveness towards each other. Conversely, it is typically very difficult for organizations to change course (keep in mind the spokesperson has no real power and a strong incentive to lie) and there is zero reason to feel bad if people abandon them. The people who work there perhaps, but there should be no mourning for an entity that exists only as a legal construct.
- robotnikman 6y ago
  It is possible for organizations to change course, but it usually requires a crisis or disaster to occur which pushes the drive for change. The book "The Power of Habit" has some good examples of large organizations changing course.
MattGaiser 6y ago
Organizations don't change without throwing out a massive number of people. The people who made bad decisions at Zoom are still there. Leopards can't change their spots.
derefr 6y ago
> It seems that we live in an era where This phrasing is sophistry: there has never been an "era" where this was not true. Humans suck; humans have never not sucked.
munificent 6y ago
For businesses, the best predictor of future behavior is past behavior.
john-radio 6y ago
The shit that we're complaining about happened like three weeks ago!

smacktoward 6y ago

Tell that to Microsoft.

lmm 6y ago

Zoom's decisions did not feel like mistakes so much as an expression of their values. The company repeatedly prioritised ease of use while doing the absolute minimum on the security front. Are there any grounds to believe that that calculus has changed?

brians 6y ago
No, but now they see that the minimum is not where they had thought. As someone who does security professionally, of course a business wants to do the minimum necessary for security. The point of security systems is to break things that would otherwise work. TLS is there to break sessions that would work under TCP. GPG is there to tell you to discard some mail.
jariel 6y ago
This is a good point. But I do think that company values do change. Zoom is getting the shining light of attention globally. Even human beings, in these situations, start to act more conscientiously, and then believe their own morality after the fact! I believe the keybase acquisition demonstrates this a bit - because they will get zero public goodwill from this - nobody on Main St. knows are cares what Keybase is, this won't be on CNN so they are probably very much trying to make things better. Owners of the company want money - now they are popular, they have to behave well to get that money. Wanting money usually transcends everything else including loyalty to state. A Chinese CEO with a popular Western product is going to realize that if his customers are way for CCP grabbing their data, it's a problem to his business. He doesn't want CCP snooping and one of the better ways to do that is to have better encryption as well. Doing slightly suspicious things doesn't matter if nobody is watching and therefore nobody cares, now that people care ... it matters. Just as a matter of pragmatism.
- motivic 6y ago
  The CEO of Zoom is a naturalized U.S. citizen. He is ethnically Chinese but by all means he is no longer legally a Chinese citizen. Source: https://en.wikipedia.org/wiki/Eric_Yuan https://en.wikipedia.org/wiki/Eric_Yuan
ViViDboarder 6y ago
The fact that they hired Alex Stamos and probably just spent a bunch of money on buying Keybase seem like a sign that things are changing. They prioritized ease of use above all to get adoption before. This is appalling to me, but I believe they are seeing enough pressure to change course. It’s believable to me that they would intend to as they have already captured much of the consumer (non-B2B) market mind share and can afford to invest in this area. Will I be using it now? Still a no. Maybe I’m time though.
- purple-dragon 6y ago
  > The fact that they hired Alex Stamos and ... Call my cynical, but "hiring" a bunch of infosec celebrities and critics as part-time consultants or contractors should be considered nothing but a (brilliant and silencing) PR move until the day that product updates and analyses reveal otherwise.
  - djrogers 6y ago
    > until the day that product updates and analyses reveal otherwise. The product (and their poor installer practice) has been updated several times in the past few months alone, and each move has made Zoom a more secure product, with the vast majority of the hubbub having been addressed. So are you simply ignoring that, or are you setting your own personal goalposts?
    - purple-dragon 6y ago
      I'm doing neither. I'm pointing out a logical fallacy in the parent comment. Hiring people part-time and buying a company does not, on its own, convey anything about improvements to product quality, security, or the corporate culture of either. I can only infer from your comment that you might think I have some beef or issue with Zoom. I said no such thing.
      - wutbrodo 6y ago
        Sure, but it's not "on its own", it's in the context of the investment in security mentioned by the parent comment.
Igelau 6y ago
> did not feel like mistakes so much as an expression of their values That's an intepretation you're choosing to make.
- albedoa 6y ago
  Calling it an interpretation is nothing short of revisionism. Nobody considers the hidden web server to have been an oversight. It required forethought and effort. It's not as if they didn't know what they were doing.
damanamathos 6y ago
You're absolutely right that past decisions focused on ease-of-use over security. For evidence that they've changed their focus you can see their April 1 blog post[1] and the weekly video AMAs they do that are summarised in their "90-Day Security Plan Progress Report" blog posts.[2] They're making a lot of progress. The Keybase acquisition is about building out a strong security team that will help them implement end-to-end encryption in 1,000 person meetings, which currently isn't possible anywhere.[3] [1] https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-users/ https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... [2] https://blog.zoom.us/wordpress/category/announcements/ https://blog.zoom.us/wordpress/category/announcements/ [3] https://twitter.com/alexstamos/status/1258405729720918016 https://twitter.com/alexstamos/status/1258405729720918016

netheril96 6y ago

Zoom is only a pariah on Hacker News.

fernandotakai 6y ago
microsoft too. people here still talk about "Embrace, extend, and extinguish" every time there's any good microsoft news.
- somebodyiknew 6y ago
  It's far easier falling back on tired memes and muscle memory, than rewiring biases.
  - xref 6y ago
    Muscle memory exists for a reason. “Stove is hot, be careful before touching it.” “Microsoft sexually discriminated in executive hires because ‘women will get pregnant and quit’, stifled completion in multiple categories, expected free overtime or you’d be stack-ranked out of a job. Be careful before trusting.”
detaro 6y ago
I have heard from multiple friends that their employers banned Zoom after the negative press. And that's quite a few non-tech companies too.
Kihashi 6y ago
About half of my employer's clients (in manufacturing) have banned use of zoom and block it at the firewall.

CivBase 6y ago

I agree that there should be opportunity for individuals to learn from mistakes and improve. People can be stubborn and slow to change, but they should be given a chance. It seems reasonable that the same courtesy should be extended to organizations. However, organizations are an order of magnitude slower to change than individuals. Ultimately, an organization's policies are a reflection of the policies of its leaders. The bigger the organization, the more leaders have to change before the organization itself can truly change. It's much more likely that those who change just move on to another organization instead. Besides, the end-to-end encryption incident wasn't a "mistake". Zoom's response was to say that their definition of end-to-end was just different from everyone else's. They clearly knew exactly what they were doing. Zoom can change, but given their size and past I want more than a corporate apology and pinky swear before I trust them. They are making plenty of money and aren't going anywhere. There's plenty of time for them to earn my trust. However, they haven't yet earned enough of my trust to make me comfortable with this acquisition.

m3kw9 6y ago

Really? Why is everyone using FB, google?

ta17711771 6y ago
Why is everyone using sugar and heroin?

Aeolun 6y ago

> It seems that we live in an era where if you made bad decisions in the past, you can never be trusted to make good decisions ever again. Even if you own your bad decisions and show lots of improvement. I've seen this turn out for the best literally one time, and that was Microsoft. All the other times the bad company just continues its horrible slide into madness. It doesn't die either, just silently keeps churning out billions of dollars of shareholder value.

yarrel 6y ago
Microsoft isn't turning out for the best, though. They are just very good at putting a dusting of Open Source sugar on things.
- Aeolun 6y ago
  However you call it, they’re producing value for me instead of (or in addition to) their shareholders.
MattGaiser 6y ago
You see Microsoft’s mediocre reliability making its way into GitHub. Has MSFT changed or are things breaking on the web just more accepted than your desktop?

sb057 6y ago

Organizations are not people. It is very straightforward for an individual to change their ways from bad to good. We should have mutual empathy and forgiveness towards each other. Conversely, it is typically very difficult for organizations to change course (keep in mind the spokesperson has no real power and a strong incentive to lie) and there is zero reason to feel bad if people abandon them. The people who work there perhaps, but there should be no mourning for an entity that exists only as a legal construct.

robotnikman 6y ago
It is possible for organizations to change course, but it usually requires a crisis or disaster to occur which pushes the drive for change. The book "The Power of Habit" has some good examples of large organizations changing course.

MattGaiser 6y ago

Organizations don't change without throwing out a massive number of people. The people who made bad decisions at Zoom are still there. Leopards can't change their spots.

derefr 6y ago

> It seems that we live in an era where This phrasing is sophistry: there has never been an "era" where this was not true. Humans suck; humans have never not sucked.

munificent 6y ago

For businesses, the best predictor of future behavior is past behavior.

john-radio 6y ago

The shit that we're complaining about happened like three weeks ago!