22 ms·

I wonder. Are all the vulnerabilities and issues with Zoom because of its popularity? Everybody is using zoom these days and in my opinion it's because it has

by Jonnax 6y ago

I wonder. Are all the vulnerabilities and issues with Zoom because of its popularity? Everybody is using zoom these days and in my opinion it's because it has an excellent user experience. I'm wondering if something like Cisco WebEx is just as "broken" but everyone doesn't have their eyes on it. One thing for sure. We need a way to run desktop applications in isolated containers in the same way mobile apps are run. I joined a WebEx meeting the other day, downloading it's client. And after the meeting a little window popped up with my next meetings. Without permission it'd hooked into my outlook calendar. At the the very least, we could have some sort of virtual file system that by default applications only see. I'm sure the capability exists in windows, because there's a mod management tool for Skyrim I've used where it creates a virtual folder for all your activated mods and the game itself sees that virtual folder when running. As an aside, remember when Skype was the most popular audio/video chat app in the world? Or even MSN messenger? I also remember Hangouts getting popular but then stagnating in using 100% CPU and setting fire to your laps.

aetherspawn 6y ago
I hate that nearly all conferencing apps (except Skype/Teams) feel like malware. And I hate that Covid means that I am pretty much forced to use have half a dozen each day.
- m0xte 6y ago
  Slack is definitely malware feeling territory. The amount of juice it requires feels like it’s running a crypto mining operation in the background.
  - boudin 6y ago
    The funny thing is that if you disable all the gif and animated gif features it behaves much better. I also disabled spelling checks, automatic replacement of emojis and this kind of not really useful things. On my work computer it went from using kind 60% of a core to almost nothing.
    - dylan604 6y ago
      I went looking for these options after ready your message. I'm now wonder why in the world is "Allow animated images and emoji" in the Accessibility section of the preferences and separated from the other options for images and media? Seems oddly located to me
    - hanniabu 6y ago
      Still doesn't excuse it from eating up all your resources. It's not a great productivity tool if you can't do anything else on your computer when it's open.
      - catalogia 6y ago
        There's an attitude I've seen bandied about a lot in recent years that "unused RAM is wasted RAM." In a literal sense, this is true. However it's nearly always misapplied. Unless your program is likely to be the raison d'être for that computer existing, then you shouldn't assume the user has all that RAM so that your program can use it. The user probably bought all that RAM for something else and you shouldn't feel justified in slurping it all up yourself.
        the_pwner224 6y ago
        > unused RAM is wasted RAM I've only ever seen this when explaining to people why Linux appears to be using all their RAM - it caches your disk to make subsequent reads faster, and when an application needs more memory the cache will be evicted immediately and at almost no performance cost. It's completely insane to suggest the user's RAM is yours to consume. Some people have 64 gb of memory in their desktops, and others have 4gb on their $300 laptop because that's all they could afford, and some have 2gb on their cheap phone.
        catalogia 6y ago
        > I've only ever seen this when explaining to people why Linux appears to be using all their RAM - it caches your disk to make subsequent reads faster, and when an application needs more memory the cache will be evicted immediately and at almost no performance cost. That's where it's taught I think, and certainly it's the truth in that context. But more than a few times I've encountered it as a defense for stuff like bloated chat programs slurping up gigabytes of RAM. With respect to hardware diversity, I think part of the problem is most programmers do their development on powerful hardware and become accustomed to it. Certainly nobody wants to sit around for an hour waiting for their build to finish on low-end hardware when a powerful computer, which they or their employer can easily afford, could finish the build in minutes. But because of that, they lose touch with end users who will be running that software on very modest hardware.
  - Shorel 6y ago
    For me, it is more a failure of the Electron/JavaScript framework everyone is using now. Find Ripcord, it is fast and works for Slack and Discord.
- Legogris 6y ago
  Jitsi Meet? https://jitsi.org/jitsi-meet/ https://jitsi.org/jitsi-meet/
  - ashildr 6y ago
    We set up a jitsy-meet server for those cases when the customer does not have teams or teams decides to not work. Jitsi does work flawlessly for us in Chrome, Firefox and Edge. I set up a private server for friends, too, to keep in contact with their family. Jitsi is a fine tool, especially with headsets (wtf, use a headset, dad!) , the main bottleneck seems to be the clients ISP downstream and the dedicated apps on tablets seem to get out of sync.
- fulafel 6y ago
  Protip: use the web based versions when you can't choose which service to use. Zoom, Teams, WebEx, Slack etc all support it. Then, when you can choose which service to use, pick one that is web-first.
  - hanniabu 6y ago
    How do you use zoom in browser? To join a chat it tells you to download the software.
    - catalogia 6y ago
      On MacOS, you have to ignore the download twice before Zoom offers to let you use your browser.
      - cesarb 6y ago
        You also have to use Chrome/Chromium, last I tried this trick of ignoring the download twice doesn't work when your browser is Firefox.
      - hanniabu 6y ago
        Well that's a bit of a hack. Might as well not even bother having that option if you need to get a magical sequence to unlock it.
- smt88 6y ago
  I specifically use UberConference because it doesn't have any desktop apps, nor does it prompt people to install anything. It's fantastic.
- wolco 6y ago
  Skpye and teams feel like malware too.
- aetherspawn 6y ago
  Just to clarify the performance penalty of these apps is not what bothers me the most, but it’s more to do with registering protocols that are susceptible to attacks, opening local ports on your computer that are browser-accessible, installing startup drivers/services and other things in the name of “user convenience” that persist well beyond me closing some of these apps. I can live with a fat app, but anything that insists on being there and having serious negative trade-offs even when not using it, in my opinion falls under malware. I hope they all uninstall cleanly after covid.
tomatocracy 6y ago
For Windows 10, there's now Windows Sandbox which is part of the OS for Pro and Enterprise - it's essentially a disposable VM. Short of that Sandboxie, which has been around for a long time, has more of a restrictions/container type approach.
- KindOne 6y ago
  Sandboxie is free and opensource now. https://community.sophos.com/products/sandboxie/f/forum/119641/important-sandboxie-open-source-code-is-available-for-download https://community.sophos.com/products/sandboxie/f/forum/1196... https://github.com/sandboxie/sandboxie https://github.com/sandboxie/sandboxie
- vladvasiliu 6y ago
  I've tried looking into Windows Sandbox but it looked like the VM can only be disposable. If you wanted it to live longer, it cannot. Also, is it possible to sandbox any app? Say, for example, Zoom.
rlpb 6y ago
This is why I appreciate having the Zoom snap. It runs sandboxed, which provides some level of mitigation against vulnerabilities. The same sandbox stops me getting "surprise integrations" that I don't want.
Jon_Lowtek 6y ago
> I wonder. Are all the vulnerabilities and issues with Zoom because of its popularity? No vulnerabilities are in production because of buggy code and lack of pre-production quality control. But yes more popularity means more free quality control by third parties. It is a sad reality of "scale first" and "cheapest offer" economies.
forgotmypw17 6y ago
>One thing for sure. We need a way to run desktop applications in isolated containers in the same way mobile apps are run. Qubes
redis_mlc 6y ago
> something like Cisco WebEx So you're going to love this. The CEO of Zoom is a former senior engineer on WebEx, funded by ex-WebEx employees and founders. Zoom was originally him plus 40 software engineers in China. If I was Cisco, I'd be wondering how much code was copied into Zoom. And if I were you, I'd be wondering why people are using an essentially Chinese communications tool. Zoom is not a normal US company that outsources to China - the entire development team started in China with a San Jose "HQ" (because Cisco is based in San Jose.)
- throw554323 6y ago
  Eric Yuan worked for WebEx before it was acquired by a Cisco. While he was at Cisco, he tried to improve WebEx, but none of his managers listened and he felt they were moving to slow [1]. He left and started his own company. He’s an American. His wife is an American. His kids are American. 1. https://www.cnbc.com/2019/08/21/zoom-founder-left-job-because-he-wasnt-happy-became-billionaire.html https://www.cnbc.com/2019/08/21/zoom-founder-left-job-becaus...
  - Sevaris 6y ago
    Nobody said he wasn't American. The team that made and works on Zoom is in China though.
    - bamboozled 6y ago
      What happens if Chinese people work on it?
      - Jon_Lowtek 6y ago
        Chinese Ministry of State Security can inject a coder/sysmin who adds vulnerabilities which are then used for espionage against corporations/governments. The National Security Agency has done things like that in the past, so it is safe to assume the chinese do it to.
        6y ago
bawolff 6y ago
The debacle with zoom installing a secret webserver that stays on your computer after uninstalling so it can reinstall zoom and also had rce vulns, happened a year ago. That was before covid and zoom's current level of popularity. So i'm going to go with no.
- throwsoundpop 6y ago
  How can we be sure there isn't a similar, more subtle version non-removable installation now? (I briefly had Zoom installed a few months ago, then un-installed it, but I don't know how to verify).
  - fiddlerwoaroof 6y ago
    If you can make a virtual machine equivalent to your computer: make one, get a list of all the files (and dump the registry on windows), then install and uninstall zoom and repeat. Then just inspect whatever the diff is.
- voicedYoda 6y ago
  Source?
  - throwanem 6y ago
    https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5 https://medium.com/bugbountywriteup/zoom-zero-day-4-million-...
  - bawolff 6y ago
    I see you were downvoted. I gave you an upvote because nobody should ever be penalized for asking people to back their claims up with a source.
deleted 6y ago
[deleted]
lewiscollard 6y ago
> I wonder. Are all the vulnerabilities and issues with Zoom because of its popularity? In a sense, yes. I think Zoom has achieved far more popularity than Zoom was prepared for. Everything about Zoom feels like it was thrown together hastily and for a much smaller audience. It may seem unrelated, but I think a microcosm of all this was: Attention tracking. They removed this feature because of its unpopularity after privacy people flagged it, which may have not happened if Zoom hadn't gotten popular. But it also shows that they have no internal brakes on this sort of thing; no strong product lead or anyone else able to push back on the PowerPoint prodders with "nope, not happening, that's fucking weird and creepy". Can you expect good code to come out of that environment? Notably, these vulnerabilities were in features I, a daily user of Zoom in these weird times, did not even know existed (code snippets and GIFs). Strikes me as more "shit rushed out of the door with no oversight and minimal code review to get boxes checked".
- dzhiurgis 6y ago
  Good code? Absolutely! Zoom works buttery smooth for amount of features it has. No other competitor comes close. Secure? Different story. But if code quality correlates with security, then most likely yes. They can push secure code.
  - chrisweekly 6y ago
    "No competitor comes close" May I introduce you to https://meet.jit.si https://meet.jit.si, which works flawlessly, is open-source, and supports e2e encryption. I really don't understand why "use Jitsi" isn't the stock answer when people start complaining about Zoom, let alone on HN.
    - dijksterhuis 6y ago
      Because there are other factors to consider for each user's use case. Jitsi wouldn't work for the Zoom meetings I admin. It's too technical for a very untechnical audience. Zoom was hard enough, and 90% of the meetings in our ecosystem use Zoom, meaning they only need one app. Asking them to use Jitsi would require two (as every other meeting uses Zoom), which means a non technical audience has to learn 2 technical things instead of 1. In the case of E2E encryption, every attendee has to type in the meeting key when they join for it to work. The users I work with will forget/won't understand why etc. They just want to speak to people. So that will render e2e useless if 1 out of 20 attendees doesn't do it. Not to mention we have attendees who don't own a smartphone so have to dial in. Making the E2E Jitsi stuff pointless. Jitsi is great for technical people. Zoom is great for non technical people.
scarface74 6y ago
I wonder. Are all the vulnerabilities and issues with Zoom because of its popularity? Zoom is a shady company that does crap like secretly install a web server on Macs that allows it to reinstall itself once installed. I refuse to install Zoom on any computer. I installed it on my iPad out of necessity where I know it’s in a strict sandbox. Edit link: https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/ https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
dzhiurgis 6y ago
If there's some external actors trying scrutinise Zoom then they are surely are making them much stronger... But if I'd have to pick one I'd guess Google has the best security analysis track record, anti-China fetish which tops the lack of clue what they are doing with their chat or conferencing products.
EGreg 6y ago
What is excellent about the Zoom user experience? Versus, say, Google Hangouts Meet, Facebook, Skype, Telegram, WhatsApp etc.?
- Jonnax 6y ago
  WhatsApp isn't a conference tool. You can't have more than a handful of people on a call. And it's with people in your contacts on your mobile phone. I presume the same with telegram. Skype for business has been deprecated by Microsoft in favour of teams. I use it daily and it's just not that great. It requires a Microsoft subscription. Google hangouts meet only just became available for everyone to use. Before it required a Google business subscription. It makes my CPU usage max out and cooks my laptop. Zoom works well with 10s of people in a call, it's easy to use. Breakout rooms is a useful feature. With COVID so many people are using it not because of a marketing campaign but because it's easy to use. I think it's like asking "why is a an iPhone better than a Blackberry? They both make calls and send email." But I think Zoom has built their product to not be "enterprise" which in my opinion is a good thing. As that usually means you need to accept jank. Of course there are security issues with the software as well.
  - EGreg 6y ago
    But aren’t there other conference tools like uberconference and jitsi? What makes them worse?
    - Jonnax 6y ago
      I don't know what you want me to say. I haven't used jitsi or uberconference. If you have, tell me why they aren't popular? Do they do anything that Zoom doesn't?
m3kw9 6y ago
Is because they are so popular, if you look at other software they all have zero day hacks. Even iOS, Windows, MacOS, Linux etc.
spicyramen 6y ago
I know the Cisco UC teams directly and Zoom Engineering as well. Cisco and Google just can't stand that so much money have been spent in acquisitions and engineering that a smaller company just beat them in the consumer and enterprise space (Cisco acquire Tandberg, Latitude, WebEx, defuncted Jabber and some of the Telepresence technology), same as Google (creators of WebRTC and few apps Hangouts, Meet, Duo, etc) that a small company beat them badly, that's the reality. Yes some Zoom Engineering is in China, so what? Unless you have solid technical proof that there is a security problem, is just gossip and bad press, I though this is a technical forum
- joking 6y ago
  Actually, I don’t think that zoom have any kind of technological improvements than the other companies you mention, as Jitsi proves, making a videocall and screen sharing app it’s not really very difficult, as the building blocks are already stablished and it’s a matter of how you join them. Zoom make the choice to try to circumvent some security things to be able to appear less hostile for the user, and it seems that it was worth it. Several other things (integration with third party calendars, conference and seminar tools) are the ice in the cake.
saagarjha 6y ago
> Are all the vulnerabilities and issues with Zoom because of its popularity? Partly, but they also actively go out of their way to disable security mitigations for reasons that are unclear so I’m not all that surprised. On Linux I think they were one simple buffer overflow away from arbitrary code execution, which is all but asking for an attack if you parse data from the network in an unsafe language.
- tomsmeding 6y ago
  To be fair, if you're parsing data from the network in an unsafe language, you are always a simple buffer overflow away from arbitrary code execution. So your point is: don't use an unsafe language.
  - saagarjha 6y ago
    There's a number of mitigations for simple buffer overflows, such as stack canaries.
tbrock 6y ago
Is the user experience on zoom that good? To me it’s barely passable because I think the bar is higher in 2020 than it was in 2000 (where getting on the conference was a miracle). 1. Today zoom links load a webpage that hits a local web server which launches the app (after some delay). There has to be a better way. Why do I need an app at all? Yes I know there is a trick to avoid using/installing the app but it’s not full featured. 2. Fans run on high during a simple video conference and my cpu melts during a screen share. Why is GPU acceleration not a thing here? None of that happens with google meet for example. Most modern CPUs have hardware support for h264/5 encoding decoding. I shouldn’t need to blow my CPU budget to show a video and play some sounds.
- perennate 6y ago
  Also in my experience Zoom's web interface is completely broken in Firefox, and in Chromium the audio frequently disconnects without any visual indication.
reaperducer 6y ago
Are all the vulnerabilities and issues with Zoom because of its popularity? Does it matter? Shoddy code is shoddy code, no matter how many people run it. A bad program may only run on one person's machine, but if that machine belongs to the Secretary of Defense, it still matters.
- mandelbrotwurst 6y ago
  It matters if you are attempting to evaluate whether it is more or less secure than some other application.
o-__-o 6y ago
Remember Kazaa? A security researcher once posited that there were almost 70 million Kazaa clients at some point. Surely one of them has a security vulnerability... I immediately shutoff Kazaa and rethought my approach to secure computing at home
Lorin 6y ago
I miss MSN messenger's doodle tool
Shorel 6y ago
> As an aside, remember when Skype was the most popular audio/video chat app in the world? Or even MSN messenger? These two only failed because Microsoft deliberately killed them. One of these things I will never understand.
dehrmann 6y ago
When I look at Zoombombing, it seems like the sort of thing someone should have flagged internally early on. I don't know anything about Zoom's culture, but a case like this makes me think being security-minded isn't in their culture. You can also see that in the CEO's statement about end-to-end encryption; his logic about how free users wouldn't get end-to-end encryption so Zoom could cooperate with law enforcement was non sequitur. Or look at how they handled Zoombombing and the lobby: if you call a contact, they still have to be admitted. Development is also mostly in China to save money. I buy the explanation, but even in 2011, China didn't have the best reputation for privacy and censorship; other countries would have been better choices.
monadic2 6y ago
with all these corporate products the motivation is to provide new features, not strengthen their (often very mediocre) core. In a security light this is just making more vulnerabilities, especially since zoom is using an unsafe language for some reason. See also: atlassian, oracle, salesforce, zendesk, etc
peterkos 6y ago
Nope! According to this article[0], Dropbox used to use Zoom internally, and no matter how many serious bugs they discovered+reported, many are still in the software today, years later. [0] https://www.nytimes.com/2020/04/20/technology/zoom-security-dropbox-hackers.html https://www.nytimes.com/2020/04/20/technology/zoom-security-...
haecceity 6y ago
> One thing for sure. We need a way to run desktop applications in isolated containers in the same way mobile apps are run. That's what Windows 10x is doing. Performance will most likely take a hit.
piracy1 6y ago
Didn't someone drop a WebX driveby RCE like 6 months ago? Edit:Like 6 months or 2 years :shrug:

by Jonnax 6y ago

aetherspawn 6y ago

I hate that nearly all conferencing apps (except Skype/Teams) feel like malware. And I hate that Covid means that I am pretty much forced to use have half a dozen each day.

m0xte 6y ago
Slack is definitely malware feeling territory. The amount of juice it requires feels like it’s running a crypto mining operation in the background.
- boudin 6y ago
  The funny thing is that if you disable all the gif and animated gif features it behaves much better. I also disabled spelling checks, automatic replacement of emojis and this kind of not really useful things. On my work computer it went from using kind 60% of a core to almost nothing.
  - dylan604 6y ago
    I went looking for these options after ready your message. I'm now wonder why in the world is "Allow animated images and emoji" in the Accessibility section of the preferences and separated from the other options for images and media? Seems oddly located to me
  - hanniabu 6y ago
    Still doesn't excuse it from eating up all your resources. It's not a great productivity tool if you can't do anything else on your computer when it's open.
    - catalogia 6y ago
      There's an attitude I've seen bandied about a lot in recent years that "unused RAM is wasted RAM." In a literal sense, this is true. However it's nearly always misapplied. Unless your program is likely to be the raison d'être for that computer existing, then you shouldn't assume the user has all that RAM so that your program can use it. The user probably bought all that RAM for something else and you shouldn't feel justified in slurping it all up yourself.
      - the_pwner224 6y ago
        > unused RAM is wasted RAM I've only ever seen this when explaining to people why Linux appears to be using all their RAM - it caches your disk to make subsequent reads faster, and when an application needs more memory the cache will be evicted immediately and at almost no performance cost. It's completely insane to suggest the user's RAM is yours to consume. Some people have 64 gb of memory in their desktops, and others have 4gb on their $300 laptop because that's all they could afford, and some have 2gb on their cheap phone.
        catalogia 6y ago
        > I've only ever seen this when explaining to people why Linux appears to be using all their RAM - it caches your disk to make subsequent reads faster, and when an application needs more memory the cache will be evicted immediately and at almost no performance cost. That's where it's taught I think, and certainly it's the truth in that context. But more than a few times I've encountered it as a defense for stuff like bloated chat programs slurping up gigabytes of RAM. With respect to hardware diversity, I think part of the problem is most programmers do their development on powerful hardware and become accustomed to it. Certainly nobody wants to sit around for an hour waiting for their build to finish on low-end hardware when a powerful computer, which they or their employer can easily afford, could finish the build in minutes. But because of that, they lose touch with end users who will be running that software on very modest hardware.
- Shorel 6y ago
  For me, it is more a failure of the Electron/JavaScript framework everyone is using now. Find Ripcord, it is fast and works for Slack and Discord.
Legogris 6y ago
Jitsi Meet? https://jitsi.org/jitsi-meet/ https://jitsi.org/jitsi-meet/
- ashildr 6y ago
  We set up a jitsy-meet server for those cases when the customer does not have teams or teams decides to not work. Jitsi does work flawlessly for us in Chrome, Firefox and Edge. I set up a private server for friends, too, to keep in contact with their family. Jitsi is a fine tool, especially with headsets (wtf, use a headset, dad!) , the main bottleneck seems to be the clients ISP downstream and the dedicated apps on tablets seem to get out of sync.
fulafel 6y ago
Protip: use the web based versions when you can't choose which service to use. Zoom, Teams, WebEx, Slack etc all support it. Then, when you can choose which service to use, pick one that is web-first.
- hanniabu 6y ago
  How do you use zoom in browser? To join a chat it tells you to download the software.
  - catalogia 6y ago
    On MacOS, you have to ignore the download twice before Zoom offers to let you use your browser.
    - cesarb 6y ago
      You also have to use Chrome/Chromium, last I tried this trick of ignoring the download twice doesn't work when your browser is Firefox.
    - hanniabu 6y ago
      Well that's a bit of a hack. Might as well not even bother having that option if you need to get a magical sequence to unlock it.
smt88 6y ago
I specifically use UberConference because it doesn't have any desktop apps, nor does it prompt people to install anything. It's fantastic.
wolco 6y ago
Skpye and teams feel like malware too.
aetherspawn 6y ago
Just to clarify the performance penalty of these apps is not what bothers me the most, but it’s more to do with registering protocols that are susceptible to attacks, opening local ports on your computer that are browser-accessible, installing startup drivers/services and other things in the name of “user convenience” that persist well beyond me closing some of these apps. I can live with a fat app, but anything that insists on being there and having serious negative trade-offs even when not using it, in my opinion falls under malware. I hope they all uninstall cleanly after covid.

tomatocracy 6y ago

For Windows 10, there's now Windows Sandbox which is part of the OS for Pro and Enterprise - it's essentially a disposable VM. Short of that Sandboxie, which has been around for a long time, has more of a restrictions/container type approach.

KindOne 6y ago
Sandboxie is free and opensource now. https://community.sophos.com/products/sandboxie/f/forum/119641/important-sandboxie-open-source-code-is-available-for-download https://community.sophos.com/products/sandboxie/f/forum/1196... https://github.com/sandboxie/sandboxie https://github.com/sandboxie/sandboxie
vladvasiliu 6y ago
I've tried looking into Windows Sandbox but it looked like the VM can only be disposable. If you wanted it to live longer, it cannot. Also, is it possible to sandbox any app? Say, for example, Zoom.

rlpb 6y ago

This is why I appreciate having the Zoom snap. It runs sandboxed, which provides some level of mitigation against vulnerabilities. The same sandbox stops me getting "surprise integrations" that I don't want.

Jon_Lowtek 6y ago

> I wonder. Are all the vulnerabilities and issues with Zoom because of its popularity? No vulnerabilities are in production because of buggy code and lack of pre-production quality control. But yes more popularity means more free quality control by third parties. It is a sad reality of "scale first" and "cheapest offer" economies.

forgotmypw17 6y ago

>One thing for sure. We need a way to run desktop applications in isolated containers in the same way mobile apps are run. Qubes

redis_mlc 6y ago

> something like Cisco WebEx So you're going to love this. The CEO of Zoom is a former senior engineer on WebEx, funded by ex-WebEx employees and founders. Zoom was originally him plus 40 software engineers in China. If I was Cisco, I'd be wondering how much code was copied into Zoom. And if I were you, I'd be wondering why people are using an essentially Chinese communications tool. Zoom is not a normal US company that outsources to China - the entire development team started in China with a San Jose "HQ" (because Cisco is based in San Jose.)

throw554323 6y ago
Eric Yuan worked for WebEx before it was acquired by a Cisco. While he was at Cisco, he tried to improve WebEx, but none of his managers listened and he felt they were moving to slow [1]. He left and started his own company. He’s an American. His wife is an American. His kids are American. 1. https://www.cnbc.com/2019/08/21/zoom-founder-left-job-because-he-wasnt-happy-became-billionaire.html https://www.cnbc.com/2019/08/21/zoom-founder-left-job-becaus...
- Sevaris 6y ago
  Nobody said he wasn't American. The team that made and works on Zoom is in China though.
  - bamboozled 6y ago
    What happens if Chinese people work on it?
    - Jon_Lowtek 6y ago
      Chinese Ministry of State Security can inject a coder/sysmin who adds vulnerabilities which are then used for espionage against corporations/governments. The National Security Agency has done things like that in the past, so it is safe to assume the chinese do it to.
      - 6y ago

bawolff 6y ago

The debacle with zoom installing a secret webserver that stays on your computer after uninstalling so it can reinstall zoom and also had rce vulns, happened a year ago. That was before covid and zoom's current level of popularity. So i'm going to go with no.

throwsoundpop 6y ago
How can we be sure there isn't a similar, more subtle version non-removable installation now? (I briefly had Zoom installed a few months ago, then un-installed it, but I don't know how to verify).
- fiddlerwoaroof 6y ago
  If you can make a virtual machine equivalent to your computer: make one, get a list of all the files (and dump the registry on windows), then install and uninstall zoom and repeat. Then just inspect whatever the diff is.
voicedYoda 6y ago
Source?
- throwanem 6y ago
  https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-an-rce-just-get-them-to-visit-your-website-ac75c83f4ef5 https://medium.com/bugbountywriteup/zoom-zero-day-4-million-...
- bawolff 6y ago
  I see you were downvoted. I gave you an upvote because nobody should ever be penalized for asking people to back their claims up with a source.

deleted 6y ago

[deleted]

lewiscollard 6y ago

> I wonder. Are all the vulnerabilities and issues with Zoom because of its popularity? In a sense, yes. I think Zoom has achieved far more popularity than Zoom was prepared for. Everything about Zoom feels like it was thrown together hastily and for a much smaller audience. It may seem unrelated, but I think a microcosm of all this was: Attention tracking. They removed this feature because of its unpopularity after privacy people flagged it, which may have not happened if Zoom hadn't gotten popular. But it also shows that they have no internal brakes on this sort of thing; no strong product lead or anyone else able to push back on the PowerPoint prodders with "nope, not happening, that's fucking weird and creepy". Can you expect good code to come out of that environment? Notably, these vulnerabilities were in features I, a daily user of Zoom in these weird times, did not even know existed (code snippets and GIFs). Strikes me as more "shit rushed out of the door with no oversight and minimal code review to get boxes checked".

dzhiurgis 6y ago
Good code? Absolutely! Zoom works buttery smooth for amount of features it has. No other competitor comes close. Secure? Different story. But if code quality correlates with security, then most likely yes. They can push secure code.
- chrisweekly 6y ago
  "No competitor comes close" May I introduce you to https://meet.jit.si https://meet.jit.si, which works flawlessly, is open-source, and supports e2e encryption. I really don't understand why "use Jitsi" isn't the stock answer when people start complaining about Zoom, let alone on HN.
  - dijksterhuis 6y ago
    Because there are other factors to consider for each user's use case. Jitsi wouldn't work for the Zoom meetings I admin. It's too technical for a very untechnical audience. Zoom was hard enough, and 90% of the meetings in our ecosystem use Zoom, meaning they only need one app. Asking them to use Jitsi would require two (as every other meeting uses Zoom), which means a non technical audience has to learn 2 technical things instead of 1. In the case of E2E encryption, every attendee has to type in the meeting key when they join for it to work. The users I work with will forget/won't understand why etc. They just want to speak to people. So that will render e2e useless if 1 out of 20 attendees doesn't do it. Not to mention we have attendees who don't own a smartphone so have to dial in. Making the E2E Jitsi stuff pointless. Jitsi is great for technical people. Zoom is great for non technical people.

scarface74 6y ago

I wonder. Are all the vulnerabilities and issues with Zoom because of its popularity? Zoom is a shady company that does crap like secretly install a web server on Macs that allows it to reinstall itself once installed. I refuse to install Zoom on any computer. I installed it on my iPad out of necessity where I know it’s in a strict sandbox. Edit link: https://www.zdnet.com/article/zoom-defends-use-of-local-web-server-on-macs-after-security-report/ https://www.zdnet.com/article/zoom-defends-use-of-local-web-...

dzhiurgis 6y ago

If there's some external actors trying scrutinise Zoom then they are surely are making them much stronger... But if I'd have to pick one I'd guess Google has the best security analysis track record, anti-China fetish which tops the lack of clue what they are doing with their chat or conferencing products.

EGreg 6y ago

What is excellent about the Zoom user experience? Versus, say, Google Hangouts Meet, Facebook, Skype, Telegram, WhatsApp etc.?

Jonnax 6y ago
WhatsApp isn't a conference tool. You can't have more than a handful of people on a call. And it's with people in your contacts on your mobile phone. I presume the same with telegram. Skype for business has been deprecated by Microsoft in favour of teams. I use it daily and it's just not that great. It requires a Microsoft subscription. Google hangouts meet only just became available for everyone to use. Before it required a Google business subscription. It makes my CPU usage max out and cooks my laptop. Zoom works well with 10s of people in a call, it's easy to use. Breakout rooms is a useful feature. With COVID so many people are using it not because of a marketing campaign but because it's easy to use. I think it's like asking "why is a an iPhone better than a Blackberry? They both make calls and send email." But I think Zoom has built their product to not be "enterprise" which in my opinion is a good thing. As that usually means you need to accept jank. Of course there are security issues with the software as well.
- EGreg 6y ago
  But aren’t there other conference tools like uberconference and jitsi? What makes them worse?
  - Jonnax 6y ago
    I don't know what you want me to say. I haven't used jitsi or uberconference. If you have, tell me why they aren't popular? Do they do anything that Zoom doesn't?

m3kw9 6y ago

Is because they are so popular, if you look at other software they all have zero day hacks. Even iOS, Windows, MacOS, Linux etc.

spicyramen 6y ago

I know the Cisco UC teams directly and Zoom Engineering as well. Cisco and Google just can't stand that so much money have been spent in acquisitions and engineering that a smaller company just beat them in the consumer and enterprise space (Cisco acquire Tandberg, Latitude, WebEx, defuncted Jabber and some of the Telepresence technology), same as Google (creators of WebRTC and few apps Hangouts, Meet, Duo, etc) that a small company beat them badly, that's the reality. Yes some Zoom Engineering is in China, so what? Unless you have solid technical proof that there is a security problem, is just gossip and bad press, I though this is a technical forum

joking 6y ago
Actually, I don’t think that zoom have any kind of technological improvements than the other companies you mention, as Jitsi proves, making a videocall and screen sharing app it’s not really very difficult, as the building blocks are already stablished and it’s a matter of how you join them. Zoom make the choice to try to circumvent some security things to be able to appear less hostile for the user, and it seems that it was worth it. Several other things (integration with third party calendars, conference and seminar tools) are the ice in the cake.

saagarjha 6y ago

> Are all the vulnerabilities and issues with Zoom because of its popularity? Partly, but they also actively go out of their way to disable security mitigations for reasons that are unclear so I’m not all that surprised. On Linux I think they were one simple buffer overflow away from arbitrary code execution, which is all but asking for an attack if you parse data from the network in an unsafe language.

tomsmeding 6y ago
To be fair, if you're parsing data from the network in an unsafe language, you are always a simple buffer overflow away from arbitrary code execution. So your point is: don't use an unsafe language.
- saagarjha 6y ago
  There's a number of mitigations for simple buffer overflows, such as stack canaries.

tbrock 6y ago

Is the user experience on zoom that good? To me it’s barely passable because I think the bar is higher in 2020 than it was in 2000 (where getting on the conference was a miracle). 1. Today zoom links load a webpage that hits a local web server which launches the app (after some delay). There has to be a better way. Why do I need an app at all? Yes I know there is a trick to avoid using/installing the app but it’s not full featured. 2. Fans run on high during a simple video conference and my cpu melts during a screen share. Why is GPU acceleration not a thing here? None of that happens with google meet for example. Most modern CPUs have hardware support for h264/5 encoding decoding. I shouldn’t need to blow my CPU budget to show a video and play some sounds.

perennate 6y ago
Also in my experience Zoom's web interface is completely broken in Firefox, and in Chromium the audio frequently disconnects without any visual indication.

reaperducer 6y ago

Are all the vulnerabilities and issues with Zoom because of its popularity? Does it matter? Shoddy code is shoddy code, no matter how many people run it. A bad program may only run on one person's machine, but if that machine belongs to the Secretary of Defense, it still matters.

mandelbrotwurst 6y ago
It matters if you are attempting to evaluate whether it is more or less secure than some other application.

o-__-o 6y ago

Remember Kazaa? A security researcher once posited that there were almost 70 million Kazaa clients at some point. Surely one of them has a security vulnerability... I immediately shutoff Kazaa and rethought my approach to secure computing at home

Lorin 6y ago

I miss MSN messenger's doodle tool

Shorel 6y ago

> As an aside, remember when Skype was the most popular audio/video chat app in the world? Or even MSN messenger? These two only failed because Microsoft deliberately killed them. One of these things I will never understand.

dehrmann 6y ago

When I look at Zoombombing, it seems like the sort of thing someone should have flagged internally early on. I don't know anything about Zoom's culture, but a case like this makes me think being security-minded isn't in their culture. You can also see that in the CEO's statement about end-to-end encryption; his logic about how free users wouldn't get end-to-end encryption so Zoom could cooperate with law enforcement was non sequitur. Or look at how they handled Zoombombing and the lobby: if you call a contact, they still have to be admitted. Development is also mostly in China to save money. I buy the explanation, but even in 2011, China didn't have the best reputation for privacy and censorship; other countries would have been better choices.

monadic2 6y ago

with all these corporate products the motivation is to provide new features, not strengthen their (often very mediocre) core. In a security light this is just making more vulnerabilities, especially since zoom is using an unsafe language for some reason. See also: atlassian, oracle, salesforce, zendesk, etc

peterkos 6y ago

Nope! According to this article[0], Dropbox used to use Zoom internally, and no matter how many serious bugs they discovered+reported, many are still in the software today, years later. [0] https://www.nytimes.com/2020/04/20/technology/zoom-security-dropbox-hackers.html https://www.nytimes.com/2020/04/20/technology/zoom-security-...

haecceity 6y ago

> One thing for sure. We need a way to run desktop applications in isolated containers in the same way mobile apps are run. That's what Windows 10x is doing. Performance will most likely take a hit.

piracy1 6y ago

Didn't someone drop a WebX driveby RCE like 6 months ago? Edit:Like 6 months or 2 years :shrug: