by casca on 4/2/20, 6:29 AM with 256 comments
by Msurrow on 4/2/20, 9:52 AM
The important part is the leaderships reaction to the situation. Compare to something like Boeing. Zoom acknowledges facts, takes responsibilty and starts fixing things. Boeings reaction to its product killing hundreds of people was “Lol user error. RTFM”. That is (apparently) what acceptable leadership can look like..
Any sw product has issues. The question is what the company does about it
by crazygringo on 4/2/20, 3:06 PM
> Over the next 90 days, we are committed to... Enacting a feature freeze, effectively immediately, and shifting all our engineering resources to focus on our biggest trust, safety, and privacy issues.
I see a lot of comments here claiming that this blog post is bland corporate apologia, doesn't take responsibility, doesn't change anything.
But this seems like a pretty legit turnaround. Overall, they seem to be addressing pretty much everything that's been brought up. They removed the Facebook SDK, they removed attention tracking, they've clarified their encryption policies in detail.
One commenter here is asking for more, for punishment, another demands their security team be fired. And I mean, if someone wants to try to sue Zoom for misusing the term E2EE then go for it, but obviously Zoom can't "punish itself" in a blog post, and pinning it on a few bad engineers feels like a scapegoat.
This seems to be positive steps, folks. Genuinely not sure what more you could be asking for from a regular for-profit business.
by gchokov on 4/2/20, 9:36 AM
Zoom had privacy and user invading issues years back. They didn't learn their lesson back then with the MacOS installers, and continued to assure us they are taking the "right steps".
My company have stopped using Zoom and we'll never go back.
by ken on 4/2/20, 1:50 PM
If their position is now that the Zoom software was designed for corporate users, e.g., that you're expected to only run it on your own VPN where you can guarantee there's no malicious network traffic, then it should have "NOT FOR CONSUMER USE" plastered all over it.
To me, this reads exactly like "Lol user error", except there's no "M" to "RTF" that ever said, for example, that its local web server stayed running after uninstallation and could take control of your camera, or that "E2E" in the Zoom docs doesn't mean the same thing as it means to the rest of the industry.
There's no responsibility being taken here. Taking responsibility would be "We fired all our 'security' people who told us we had best-of-breed security, and hired some actual security experts to re-architect our system to provide actual security for our users." What they did here is indistinguishable from "We're sorry we got caught!" except in verbosity.
by tobr on 4/2/20, 1:32 PM
To me it just comes across as an attempt to deliberately confuse the issue.
by Quanttek on 4/2/20, 2:32 PM
That is such a dishonest way of framing it. No one was really concerned whether they would "sell" data. The issue was with the exorbitant amount of data they collect and its analysis for commercial purposes, be it ads (which doesn't involve selling data), targeted pricing or providing access to corporate admins.
by pjfunk on 4/2/20, 11:58 AM
However small or big, a company shouldn't be selling data without user consent, shouldn't use terms end-to-end encryption while make otherwise claims.
This behaviour should be punishable
by seemslegit on 4/2/20, 10:56 AM
The use of "end to end encryption" designation was no confusion, it was deception - it is implausible that this could have been done accidentally or as a result of a misunderstanding without engineers warning managers that this is not how zoom works and being overridden in their objections to communicate it as such.
They also double down on data collection. Disclosure does not establish consent and "we do not sell data" is a red herring because data can still be shared with third parties for business purposes against the interests of the users without being overtly sold (not to mention with governments under various "compelled cooperation" arrangements) and the entire policy can be subject to retroactive change without recourse.
The fact that they were targeting organizations with IT support is irrelevant except maybe to discredit the people within those organizations who greenlighted Zoom.
The saddest part is that it is unlikely any of the competing corporate offers are any better in any of those respect, but then they are not being actively pumped these days.
by shadowgovt on 4/2/20, 2:17 PM
Remember when Twitter was incredibly unstable? That was fine when it had only ten thousand users. They had to fix it fast when it had a million. But the thing is: that seems to be viable software practice (rush on features, forget about the robustness and the corner cases) because it keeps working.
by Nullabillity on 4/2/20, 9:54 AM
Give me a break..
by tyingq on 4/2/20, 11:19 AM
Oh, I missed that one. https://support.zoom.us/hc/en-us/articles/115000538083-Atten...
by oandrei on 4/2/20, 3:25 PM
Professor uses Wacom and Inkscape to draw a picture, which is incrementally transmitted to students' computers. Students, those who have Wacom, may interact. Or just watch. Transmission happens every time the svg file is saved. Transmission requires a RabbitMQ server, which can be easily set up. Basically, a class needs one person who knows Linux, to set up the server.
It is intended for scientific collaboration or teaching in small groups of people. I am now using it for teaching my QFT class, although it only has 5 students. In principle, it should scale, but I have not tried it for large groups...
Drawing with Wacom in Inkscape is a pleasure, once you get used to it. In some sense, it is more convenient than using a physical blackboard. Although, some training is needed...
by fvdessen on 4/2/20, 9:53 AM
by whatok on 4/2/20, 6:41 PM
by cmcd on 4/2/20, 2:58 PM
Excerpt from their previous release above, only a few hours earlier.
Glad to hear they are starting to make improvements but waiting for public backlash to fix issues is a bad sign.
by jefftk on 4/2/20, 4:42 PM
by nelsonic on 4/2/20, 9:43 AM
by kmtrowbr on 4/2/20, 5:27 PM
Think through this situation — 90,000 schools suddenly using Zoom, children doing their classes. What is most important: option 1) it just works option 2) it’s 100% secure
Imagine you were a member of Zoom's team, would you not be justified in feeling proud right now?
by juliend2 on 4/2/20, 2:00 PM
The windows changelog[1] doesn't talk about a version released on April 1st, like the press release says[2].
So is the only way to mitigate that issue for non-techie users is to deactivate the chat feature for all conversations?
[1] https://support.zoom.us/hc/en-us/articles/201361953-New-Upda...
[2] https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u...
by Nevada-Smith on 4/2/20, 4:10 PM
Interesting that he would point out the failure of thousands of IT departments around the world.
by talkingtab on 4/2/20, 6:10 PM
People need transparency.
by hyko on 4/2/20, 6:18 PM
They didn’t even bother to build up a reputation; hard to see how they’re going to build respect for people’s privacy and security into their culture now.
by _pmf_ on 4/2/20, 3:24 PM
Then there's the issue that Zoom is now suddenly responsible for the complete lack of security awareness of teachers and middle managers who have never before held online classes, and are publicly posting meeting credentials so that everyone can join.
All, of course, while the while world is free loading (yes, "you are the product, hurr durr"; great contribution).
by Dowwie on 4/2/20, 3:46 PM
by jasonv on 4/2/20, 5:09 PM
And they obviously have the business and engineering talent to make a good product (it's better than their competition, I'll grant).
But how much of their market share came because of some nefarious business and technical practices?
Forgive and forget, 'cause "correction"?
by ivanfon on 4/2/20, 3:21 PM
by lxe on 4/2/20, 4:03 PM
Sounds like folks at Zoom take privacy and security related feedback pretty seriously.
by xenocyon on 4/2/20, 5:33 PM
by yalogin on 4/2/20, 1:14 PM
by rado on 4/2/20, 10:19 AM
by jbverschoor on 4/2/20, 10:19 AM
First, some background: our platform was built primarily for enterprise customers – large institutions with full IT support
These new, mostly consumer use cases have helped us uncover unforeseen issues with our platform
Never ever gonna use zoom.. I got rid of it a long time ago when I found out about the malware...
by oliwarner on 4/2/20, 12:27 PM
And this wasn't anything but an acknowledgement that they're not qualified to produce the software they're distributing. They still don't even know what they don't know.
by empressplay on 4/2/20, 11:44 AM
by NKosmatos on 4/2/20, 6:41 AM
by hc91 on 4/2/20, 10:40 AM