> The UK home secretary Amber Rudd has previously called encryption "completely unacceptable" ... Theresa May has said that the big internet companies give terrorists "safe spaces" to communicate.

Ironically, the UK government in fact uses Zoom for all its meetings depsite privacy and security implications. Saudi Arabia, take note.

Ref: https://www.businessinsider.com/coronavirus-boris-johnson-zo...

So with the right URL, you can tell them yourself!

Actually: Just a screenshot tweeted by Boris Johnson himself should be enough (if he was faster to tweet it): https://twitter.com/BorisJohnson/status/1244985949534199808

That's terrible for national security. Zoom engineers are based in China: https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...

It doesn't matter where they're based. What matters is that Zoom isn't safe by any measure and tells you about that if you spend a little time reading critically.

It’s certainly no less safe than the backdoored-for-decades phone/fax networks used by medical professionals to discuss medical secrets with patients and send prescriptions to pharmacies. It’d be nice if it was more safe, but it’s hard to sink lower than a telco line.

You can send faxes to someone without the telco running a local webserver on your fax machine, and you don't run thousands of other applications on your fax machine, and your fax machine doesn't usually come with a nifty record feature, nor a camera and a microphone.

I hesitate to point this out, but quite a lot of fax machines come with a microphone.

(And, noting the prevalence of articles from a few years ago talking about "update your fax machine firmware", I suspect you could fuzz their telco line-parser for very interesting results!)

Good point--you're talking about the embedded handset or something else? That said, as you hint at: not quite the same thing from a threat model perspective :)

Indeed!

That depends entirely on whether the handset is physically disconnected by the on-hook switch, or if a firmware exploit could remotely enable it.

Threat modeling a fax machine in the era of fuzzing-RCEs is a particularly interesting thing to consider.

If they're based in Australia they can be legally coerced into installing any code the Australian government feels like telling them to insert. So I'm not sure that China is much worse.

Charles tells me that when I installed Zoom, my iPhone made four HTTPS connections to zoom.com.cn/69.174.108.252

Zoom raises the possibility of this perception in their S-1 filing [0]:

"we have a high concentration of research and development personnel in China, which could expose us to market scrutiny regarding the integrity of our solution or data security features"

[0]: https://www.sec.gov/Archives/edgar/data/1585521/000119312519...

Components of the GB 5g network are also being outsourced to China. Some of the ruling party's MP's are not happy about it.

The noisy back-benchers are a little silly as all of Huawei's work is scrutenised: https://www.wired.co.uk/article/huawei-gchq-security-evaluat...

Of course, in the UK, calling Tory back-benchers "a little silly" is an understatement.

Are the NATO countries refusing to use Huawei's work for their 5g networks also all "a little silly"?

What if Huawei was Russian, would it still be "a little silly"?

It goes far further than stupid comments by our (former) prime minister. The current legislation (passed in 2018) allows the government to force the installation of backdoors through a process that doesn't have any judicial overview or substantial public scrutiny whatsoever.

Number one reason we dropped JIRA.

Out of curiosity, what did you switch to?

Why? How is it related to Jira?

Atlassian is an Australian company, headquartered in Sydney, though the current plc is legally in the UK. (I have no idea if that means they're bound by said backdoor law.)

They are because they provide services to Australians and have an Australian subsidiary -- just as anyone in Australia must comply with a warrant or any other lawful request by law enforcement.

If they employ a single Aussie developer, or have foreign developers on Australian soil, the government can coerce those developer to insert anything they like.

This is not quite true, though it was reported widely. The legislation doesn't consider individuals as "designated communications providers" if they work for one (unless they are self-employed or sole traders). The way it works is that your employer gets a TCN and then they disclose it to the employees necessary to implement it.

But note that if you have an Australian employee (unless they are a sole trader / contractor) you must already have an Australian subsidiary of your company (for tax and superannuation reasons).

Don't get me wrong, I am absolutely opposed to this legislation and think it is a draconian overstep of government power which (despite the PR spin doled out by the government) was absolutely not necessary for effective law enforcement. But it's best not to fall into the trap of overstating what the law actually allows the government to do.

useful correction, thanks :)

Atlassian is based in Australia.

I realize HN will think much the same of it either way, but AFAICT that second quote of yours is a lie; she called WhatsApp's encryption unacceptable, not encryption in general.

"Encryption we can't backdoor isn't acceptable"

> The laws of mathematics are very commendable, but the only law that applies in Australia is the law of Australia,” said Turnbull.

Heh, that reminds me of the Indiana Pi Bill[0], where the state tried to legislate the value of pi to be 3.2.

[0]https://en.wikipedia.org/wiki/Indiana_Pi_Bill

> ... the [former] UK prime minister Theresa May has said that the big internet companies give terrorists “safe spaces” to communicate.

Yes, IIRC she also said wanted to enter a dialogue about this "with the people that know the right hashtags"!

That was Amber Rudd.