Zoom's decisions did not feel like mistakes so much as an expression of their values. The company repeatedly prioritised ease of use while doing the absolute minimum on the security front. Are there any grounds to believe that that calculus has changed?

No, but now they see that the minimum is not where they had thought. As someone who does security professionally, of course a business wants to do the minimum necessary for security. The point of security systems is to break things that would otherwise work.

TLS is there to break sessions that would work under TCP. GPG is there to tell you to discard some mail.

The fact that they hired Alex Stamos and probably just spent a bunch of money on buying Keybase seem like a sign that things are changing.

They prioritized ease of use above all to get adoption before. This is appalling to me, but I believe they are seeing enough pressure to change course. It’s believable to me that they would intend to as they have already captured much of the consumer (non-B2B) market mind share and can afford to invest in this area.

Will I be using it now? Still a no. Maybe I’m time though.

> The fact that they hired Alex Stamos and ...

Call my cynical, but "hiring" a bunch of infosec celebrities and critics as part-time consultants or contractors should be considered nothing but a (brilliant and silencing) PR move until the day that product updates and analyses reveal otherwise.

> until the day that product updates and analyses reveal otherwise.

The product (and their poor installer practice) has been updated several times in the past few months alone, and each move has made Zoom a more secure product, with the vast majority of the hubbub having been addressed. So are you simply ignoring that, or are you setting your own personal goalposts?

I'm doing neither. I'm pointing out a logical fallacy in the parent comment. Hiring people part-time and buying a company does not, on its own, convey anything about improvements to product quality, security, or the corporate culture of either. I can only infer from your comment that you might think I have some beef or issue with Zoom. I said no such thing.

Sure, but it's not "on its own", it's in the context of the investment in security mentioned by the parent comment.

At this point, I'm confused, and I'm not sure what point you or the other commenter are looking for me to concede. Zoom is paying some security consultants, pushed out some product updates, and bought Keybase, so it's a story book ending?

Just as your comment was aiming to narrowly point out a logical fallacy in the parent comment, I'm pointing out a flaw in your own: I disagree with your claim that investing in security practices is just theater, and that more concrete efforts in the same direction are irrelevant. The concrete efforts are Bayesian evidence that the newer investments are more than theater.

I didn't claim that. I believe in investing in security. I'm a security professional.

You said that those things are theater until the day the product updates. We are beyond the day when that happened. So for it to be a fallacy you have to reject the context in which it was presented, which nobody but you is doing.

It's a SaaS world, baby. Product updates (can) happen everyday. I'm not sure what that proved.

Good catch, that was a misphrasing in my comment. I meant to say _Zoom's_ investments in security, not security investments in general.

I am not looking for you to concede anything. You said nothing has been done to show you that the calculus of their priorities has changed and I listed some things that could possibly show that. It’s up to you if you believe that is significant enough to convince you.

Frankly, I don’t care if it does or not. I was just providing some visible signs of investment.

I didn't see you respond to my comment in this thread unless you post under two different accounts.

You're absolutely right that past decisions focused on ease-of-use over security.

For evidence that they've changed their focus you can see their April 1 blog post[1] and the weekly video AMAs they do that are summarised in their "90-Day Security Plan Progress Report" blog posts.[2]

They're making a lot of progress.

The Keybase acquisition is about building out a strong security team that will help them implement end-to-end encryption in 1,000 person meetings, which currently isn't possible anywhere.[3]

[1] https://blog.zoom.us/wordpress/2020/04/01/a-message-to-our-u... [2] https://blog.zoom.us/wordpress/category/announcements/ [3] https://twitter.com/alexstamos/status/1258405729720918016

This is a good point.

But I do think that company values do change.

Zoom is getting the shining light of attention globally. Even human beings, in these situations, start to act more conscientiously, and then believe their own morality after the fact!

I believe the keybase acquisition demonstrates this a bit - because they will get zero public goodwill from this - nobody on Main St. knows are cares what Keybase is, this won't be on CNN so they are probably very much trying to make things better.

Owners of the company want money - now they are popular, they have to behave well to get that money. Wanting money usually transcends everything else including loyalty to state. A Chinese CEO with a popular Western product is going to realize that if his customers are way for CCP grabbing their data, it's a problem to his business. He doesn't want CCP snooping and one of the better ways to do that is to have better encryption as well.

Doing slightly suspicious things doesn't matter if nobody is watching and therefore nobody cares, now that people care ... it matters. Just as a matter of pragmatism.

The CEO of Zoom is a naturalized U.S. citizen. He is ethnically Chinese but by all means he is no longer legally a Chinese citizen.

Source: https://en.wikipedia.org/wiki/Eric_Yuan

> did not feel like mistakes so much as an expression of their values

That's an intepretation you're choosing to make.

Calling it an interpretation is nothing short of revisionism. Nobody considers the hidden web server to have been an oversight. It required forethought and effort. It's not as if they didn't know what they were doing.

Organizations are not people. It is very straightforward for an individual to change their ways from bad to good. We should have mutual empathy and forgiveness towards each other. Conversely, it is typically very difficult for organizations to change course (keep in mind the spokesperson has no real power and a strong incentive to lie) and there is zero reason to feel bad if people abandon them. The people who work there perhaps, but there should be no mourning for an entity that exists only as a legal construct.

It is possible for organizations to change course, but it usually requires a crisis or disaster to occur which pushes the drive for change.

The book "The Power of Habit" has some good examples of large organizations changing course.

I agree that there should be opportunity for individuals to learn from mistakes and improve. People can be stubborn and slow to change, but they should be given a chance. It seems reasonable that the same courtesy should be extended to organizations. However, organizations are an order of magnitude slower to change than individuals.

Ultimately, an organization's policies are a reflection of the policies of its leaders. The bigger the organization, the more leaders have to change before the organization itself can truly change. It's much more likely that those who change just move on to another organization instead.

Besides, the end-to-end encryption incident wasn't a "mistake". Zoom's response was to say that their definition of end-to-end was just different from everyone else's. They clearly knew exactly what they were doing.

Zoom can change, but given their size and past I want more than a corporate apology and pinky swear before I trust them. They are making plenty of money and aren't going anywhere. There's plenty of time for them to earn my trust. However, they haven't yet earned enough of my trust to make me comfortable with this acquisition.

Organizations don't change without throwing out a massive number of people. The people who made bad decisions at Zoom are still there.

Leopards can't change their spots.

Zoom is only a pariah on Hacker News.

I have heard from multiple friends that their employers banned Zoom after the negative press. And that's quite a few non-tech companies too.

microsoft too. people here still talk about "Embrace, extend, and extinguish" every time there's any good microsoft news.

It's far easier falling back on tired memes and muscle memory, than rewiring biases.

Muscle memory exists for a reason.

“Stove is hot, be careful before touching it.”

“Microsoft sexually discriminated in executive hires because ‘women will get pregnant and quit’, stifled completion in multiple categories, expected free overtime or you’d be stack-ranked out of a job. Be careful before trusting.”

About half of my employer's clients (in manufacturing) have banned use of zoom and block it at the firewall.

> It seems that we live in an era where if you made bad decisions in the past, you can never be trusted to make good decisions ever again. Even if you own your bad decisions and show lots of improvement.

I've seen this turn out for the best literally one time, and that was Microsoft.

All the other times the bad company just continues its horrible slide into madness. It doesn't die either, just silently keeps churning out billions of dollars of shareholder value.

You see Microsoft’s mediocre reliability making its way into GitHub. Has MSFT changed or are things breaking on the web just more accepted than your desktop?

Microsoft isn't turning out for the best, though.

They are just very good at putting a dusting of Open Source sugar on things.

However you call it, they’re producing value for me instead of (or in addition to) their shareholders.

The shit that we're complaining about happened like three weeks ago!

For businesses, the best predictor of future behavior is past behavior.

Tell that to Microsoft.

Really? Why is everyone using FB, google?

> It seems that we live in an era where

This phrasing is sophistry: there has never been an "era" where this was not true. Humans suck; humans have never not sucked.