There was plenty of criticism before. Remember they were the company that ran an unauthenticated web server bound to localhost so that any website could make requests to it and get the video stream. And they made it so that an uninstall wouldn't remove that.

That was July.

https://www.schneier.com/blog/archives/2019/07/zoom_vulnerab...

Zoom IPOd in mid-April 2019. In terms of "start up that made it" or "growing pains", this is what happens when you don't hire a seasoned PR team (and even then). No one was looking all that hard at Zoom's technical practices because no one technical cared that much. Now that the UK Prime Minister is tweeting screenshots which include the zoom meeting ID, it's suddenly become a lot more interesting to lots of people, some of them less scrutable than others.

Zoom's older competitors; Microsoft (Skype), Google (Meet), WebEx, etc have undergone similar scrutiny with the similar results - bad press followed by engineering fix.

It actually sounds more like technical hiring and engineering culture was not good, rather than just PR.

I know we all make mistakes, bugs happen, etc. However, if you can't reason through why it's not safe to bind an HTTP server to localhost and consider clients trusted on a laptop that might also run a web browser ... This and other prominent bugs suggests that among other things, security was not a part of the culture or mindset of the rank and file. I don't think you can use "it's a startup, bro" as an excuse for that.

> unauthenticated web server bound to localhost so that any website could make requests to it and get the video stream

I read the linked article. At no point did it (or as far as I can recall any of the coverage at the time) say that the video stream data could be accessed via the local web server. The problem was already bad; no need to make spurious claims to make it worse.

Ok, maybe that was my slight misreading of the situation. It definitely involved use of the webcam without user consent, however. And an attacker could make you join a meeting that they control, effectively being able to watch and hear you.

Oh absolutely. I'm not trying to downplay the serious nature of the vulnerability, particularly because it also lead to the possibility of remote code execution. Just want to keep the record straight that at no point did this vulnerability allow people to actively spy on your legitimate meetings.

Excuse me, what the f? Link? edit: Thanks

I think directing the Eye of Sauron upon any company-required software is a modern form of collective bargaining. Individually, at many companies around the world, one engineer's concerns about Zoom or w/e will not reach or convince HR. But that same number of engineers all finding and publishing vulns in unison will convince the same number of admin people to not use Zoom. Because it gives a sense of "technical consensus" - the engineering-decision version of solidarity - I guess??

It's software that's taking over the world by the storm, suddenly used by countless companies, governments, hospitals, schools, etc.

They need scrutiny, especially given that their security record is subpar. Bad actors aren't self-isolating themselves from internet during pandemic.

If I were a bad actor, I'd totally go after Zoom as an attack vector, given its sudden adoption, without proper security reviews by organizations.

That's just because their approach to building secure software for the masses is garbage.

This software smells like it started as an internal tool for a company that escaped.

It certainly has a weird janky feel for how it integrates with the system.

My wife sent me a link to join a meeting for testing. Normally when you have a link and want to have a desktop app use it there's some protocol handler that's registered with the app.

Nope - you click the link, it downloads what appears to be an on-the-fly generated exe that talks to desktop zoom.

I get the "remove all friction" sentiment but it feels so off compared to any other web/desktop stack of technology.

Any time something gets this sort of massive usage boost it is going to be targeted by security researchers.

The best way to weather it is to write secure software that doesn't do stupid thngs (like reinventing sudo without protections) and not to slimy things (like trying to deceive your users about your lack of end-to-end encryption). If you choose to do those things instead, people are going to talk about it.

Because many more people have started using it and are running into a multitude of issues... with everything.

It doesn't help that Zoom has a history of bad practices. Just last year Apple had to issue a silent security updates to macOS to patch Zoom's zero day vulnerabilities Zoom denied existed.

It's a side effect of the flurry of covid stories. See https://news.ycombinator.com/item?id=22751116 for more.

I think that people are taking discount shorts of the stock (which are unlikely to pay out right now) and then trying to cause price dips to profit from disclosing their information. If someone just released a zero day about Zoom without prior disclosure to Zoom, it would be a useful thing for the SEC to look into more closely.

I've noticed this too. It's also on other news sites like Slashdot. It comes off like a smear campaign

I don't think so, the criticism seems well-deserved. It just seems like a natural effect of being thrust into mainstream consciousness due to more people using it while working from home.

The edge cases get a lot more attention when the sample size is increased.

I'm not at all saying this is one, but this is what an organized campaign looks like.

Have you noticed the number of people claiming that Zoom is the subject of an organised campaign? I'm not saying it's an organised whitewashing counter-campaign, but that's what one looks like ...

... and so on