4 ms·

Yet another (relative) win for the browser environment: "We also know that the method works on the Windows and Mac version of the Zoom software, but does not a

Yet another (relative) win for the browser environment: "We also know that the method works on the Windows and Mac version of the Zoom software, but does not affect the browser version."

junon 6y ago
I don't think this is the right conclusion to jump to. Browsers have a mountain of issues in their own right.
- hvis 6y ago
  And an order of magnitude more security researchers trying to poke holes in them, too.
- theobeers 6y ago
  Of course they do. I have in mind the choice that we're often given these days, between a native (or pseudo-native) desktop app and an in-browser version with comparable functionality. Perhaps I should have been clearer about that in my earlier comment.
tyingq 6y ago
We don't know much about the RCE. It may have been able to do something in the browser, with more effort, e̶s̶p̶e̶c̶i̶a̶l̶l̶y̶ ̶g̶i̶v̶e̶n̶ ̶t̶h̶a̶t̶ ̶t̶h̶e̶ ̶"̶n̶a̶t̶i̶v̶e̶ ̶a̶p̶p̶"̶ ̶h̶e̶r̶e̶ ̶i̶s̶ ̶a̶n̶ ̶E̶l̶e̶c̶t̶r̶o̶n̶ ̶a̶p̶p̶. Perhaps they stopped once they saw they had done enough for the $200k bounty. Edit: Not an electron app.
- jcelerier 6y ago
  > It may have been able to do something in the browser, with more effort, especially given that the "native app" here is an Electron app. Zoom is a C++ / Qt app
  - tyingq 6y ago
    Ah, thanks. I was fooled by the presence of an Electron SDK from Zoom.
  - BlueTemplar 6y ago
    Oh, really?! But then, why does it suck so much at "window management" (especially the "chat" feature) ??
    - jrockway 6y ago
      I don't think Qt has ever pretended to look native. I remember using KDE back in the early 2000s and most Qt apps that didn't explicitly integrate with KDE didn't look "native" either. The other desktop OSes are not even internally consistent -- look at Windows's "settings" vs. "control panel". Which one is native? The answer is they both are, sort of, but there are simply two UI kits bundled with the OS. One is deprecated, the other isn't ready yet. Qt is not going to solve that problem for you. (I'll also point out that even if you have a Win32ChatWidget in the library, that doesn't many anyone is going to use it. Zoom simply did a bad job implementing chat, which is why it's so bad. The UI toolkit library is neither the problem nor the solution. Caring about making chat good is the solution.)
      - BlueTemplar 6y ago
        For me this was never about the look, but about the features. Zoom chat isn't even able to do scrolling properly !!
        jcelerier 6y ago
        huh, what do you mean by that ?
        BlueTemplar 6y ago
        Have you already tried to paste long(ish) text into Zoom chat ? It literally starts going (hidden) outside of the window ! I've been using software since Windows 3.11, and I don't remember that ever happening before !!
- deleted 6y ago
  [deleted]

Yet another (relative) win for the browser environment: "We also know that the method works on the Windows and Mac version of the Zoom software, but does not affect the browser version."

junon 6y ago

I don't think this is the right conclusion to jump to. Browsers have a mountain of issues in their own right.

hvis 6y ago
And an order of magnitude more security researchers trying to poke holes in them, too.
theobeers 6y ago
Of course they do. I have in mind the choice that we're often given these days, between a native (or pseudo-native) desktop app and an in-browser version with comparable functionality. Perhaps I should have been clearer about that in my earlier comment.

tyingq 6y ago

We don't know much about the RCE. It may have been able to do something in the browser, with more effort, e̶s̶p̶e̶c̶i̶a̶l̶l̶y̶ ̶g̶i̶v̶e̶n̶ ̶t̶h̶a̶t̶ ̶t̶h̶e̶ ̶"̶n̶a̶t̶i̶v̶e̶ ̶a̶p̶p̶"̶ ̶h̶e̶r̶e̶ ̶i̶s̶ ̶a̶n̶ ̶E̶l̶e̶c̶t̶r̶o̶n̶ ̶a̶p̶p̶. Perhaps they stopped once they saw they had done enough for the $200k bounty. Edit: Not an electron app.

jcelerier 6y ago
> It may have been able to do something in the browser, with more effort, especially given that the "native app" here is an Electron app. Zoom is a C++ / Qt app
- tyingq 6y ago
  Ah, thanks. I was fooled by the presence of an Electron SDK from Zoom.
- BlueTemplar 6y ago
  Oh, really?! But then, why does it suck so much at "window management" (especially the "chat" feature) ??
  - jrockway 6y ago
    I don't think Qt has ever pretended to look native. I remember using KDE back in the early 2000s and most Qt apps that didn't explicitly integrate with KDE didn't look "native" either. The other desktop OSes are not even internally consistent -- look at Windows's "settings" vs. "control panel". Which one is native? The answer is they both are, sort of, but there are simply two UI kits bundled with the OS. One is deprecated, the other isn't ready yet. Qt is not going to solve that problem for you. (I'll also point out that even if you have a Win32ChatWidget in the library, that doesn't many anyone is going to use it. Zoom simply did a bad job implementing chat, which is why it's so bad. The UI toolkit library is neither the problem nor the solution. Caring about making chat good is the solution.)
    - BlueTemplar 6y ago
      For me this was never about the look, but about the features. Zoom chat isn't even able to do scrolling properly !!
      - jcelerier 6y ago
        huh, what do you mean by that ?
        BlueTemplar 6y ago
        Have you already tried to paste long(ish) text into Zoom chat ? It literally starts going (hidden) outside of the window ! I've been using software since Windows 3.11, and I don't remember that ever happening before !!
deleted 6y ago
[deleted]