So you're going to love this.

The CEO of Zoom is a former senior engineer on WebEx, funded by ex-WebEx employees and founders.

Zoom was originally him plus 40 software engineers in China.

If I was Cisco, I'd be wondering how much code was copied into Zoom.

And if I were you, I'd be wondering why people are using an essentially Chinese communications tool.

Zoom is not a normal US company that outsources to China - the entire development team started in China with a San Jose "HQ" (because Cisco is based in San Jose.)

He’s an American. His wife is an American. His kids are American.

1. https://www.cnbc.com/2019/08/21/zoom-founder-left-job-becaus...

You know NSA is an American Agency, and America is not China - there is a free enterprise. The only way they can "arm-twist" you is by rules and regulations that every company has to follow. In other words - NSA cannot force you to break the law.

Where is this so-called "arm-twisting" ??

Even if it wasn't a metaphor the US has been known to physically harass people for Software more than any other regardless of what the people did.

Some examples please?

Unless what you saying is that some programmer neck was crushed for 8 minutes because they didn't want to implement backdoor??

[1] https://www.washingtonpost.com/world/national-security/nsa-i...

... oh wait your premise disqualifies that.

Well Arabia and Russia are starting to force data being processed and stored in their territory by blocking foreign comm-tech. But i don't think that is a solution, that is just digital nationalism driven by fear of espionage and demand for the power of mass surveillance.

What "the world" should do is lobby against nation-states and mega-corps having their noses in everything, because it is a central building block of totalitarianism. Even if the state doesn't go all out authoritarian, it opens back doors that leave people vulnerable to abuse by bad actors.

You sidestepped my main point, that US/CCP is a laughably false equivalency.

A proven case? Look at Crypto AG. Sure one might argue the whole company was planted, so it doesn't count ...

For regular citizens, in USA, isn't having NSA know your stuff worse than having CCP know it?

Chinese as in "under the jurisdiction the Chinese government"? Well... quite a bit. The comment was pretty specific about it being the location.

Wait, what??

While this is true, both he and his wife were born in China, and it's not clear if they renounced their Chinese citizenship. I buy their explanation that development is done in China to save money, but it's an interesting choice for someone so concerned with looking like an American company.

Why not? As I'm in the UK I assume that either I use a USA based product and have my data open to USA government sponsored TLAs, or use proprietary products from other countries and have their secret agencies have some sort of access.

With Five-Eyes, or Maximator, mainstream development in one of the countries involved suggests there's going to be intelligence agency access.

For private citizens access by CCP is probably (unless you have links to China) far lower risk than using software connected to Western nations.

I don't have need of secret communications really; Jitsi (meet.jit.si serves my needs when I get to choose the video chat software; family and friends seem happy with it).

People use it because it's currently the best product.

For us at our university, ease of use and the fact that it allows the speaker of a talk to see the audience while sharing screen made it the preferable tool.

Sorry for the amp link I'm in a hurry I have a zoom call in a few minutes

https://www.google.com/amp/s/technode.com/2020/04/13/is-zoom...

It would have taken you less time to fetch the original link than to type that.

I'm on mobile, it was part true. I really had no idea I needed to click on that tiny i and didn't have time to do a search by title.

Typing in mobile is really fast type days. I have a full keyword/small phone. I started training myself to type faster on mobile by coding on a mobile editor a few years ago. It is so much more difficult at first but you become more focused with time. Add in a free editor app with ad popups every few minutes for additional challenge.

[1] https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...

(I briefly had Zoom installed a few months ago, then un-installed it, but I don't know how to verify).

[0] https://www.nytimes.com/2020/04/20/technology/zoom-security-...

In a sense, yes. I think Zoom has achieved far more popularity than Zoom was prepared for. Everything about Zoom feels like it was thrown together hastily and for a much smaller audience.

It may seem unrelated, but I think a microcosm of all this was: Attention tracking. They removed this feature because of its unpopularity after privacy people flagged it, which may have not happened if Zoom hadn't gotten popular. But it also shows that they have no internal brakes on this sort of thing; no strong product lead or anyone else able to push back on the PowerPoint prodders with "nope, not happening, that's fucking weird and creepy".

Can you expect good code to come out of that environment?

Notably, these vulnerabilities were in features I, a daily user of Zoom in these weird times, did not even know existed (code snippets and GIFs). Strikes me as more "shit rushed out of the door with no oversight and minimal code review to get boxes checked".

Secure? Different story. But if code quality correlates with security, then most likely yes. They can push secure code.

May I introduce you to https://meet.jit.si, which works flawlessly, is open-source, and supports e2e encryption.

I really don't understand why "use Jitsi" isn't the stock answer when people start complaining about Zoom, let alone on HN.

Jitsi wouldn't work for the Zoom meetings I admin. It's too technical for a very untechnical audience.

Zoom was hard enough, and 90% of the meetings in our ecosystem use Zoom, meaning they only need one app. Asking them to use Jitsi would require two (as every other meeting uses Zoom), which means a non technical audience has to learn 2 technical things instead of 1.

In the case of E2E encryption, every attendee has to type in the meeting key when they join for it to work. The users I work with will forget/won't understand why etc. They just want to speak to people. So that will render e2e useless if 1 out of 20 attendees doesn't do it.

Not to mention we have attendees who don't own a smartphone so have to dial in. Making the E2E Jitsi stuff pointless.

Jitsi is great for technical people. Zoom is great for non technical people.

None of our extended family c.20 people from teens to elders (c.80yo) needed help - we've been using it daily amongst us since the pandemic broke out.

People who have used Zoom several times still need help; it's more complex (that's good and bad).

EDIT -- I've actually just gone off to try out jitsi again (i do actually check to see if it's worth switching platforms) and it turns out it asks me to install an android app too. So Jit.si itself actually needs me to download software on my smartphone. So......

There are a myriad of things that mean Zoom fits our use case better. I'm not going to enumerate all of them as I'd be here for an hour.

My point was that Zoom fits some use cases better, and that seems to be the case more often than not for users with less technical ability than the HN userbase.

But technical "whizzkid stuff" (as they call it) is not something they are comfortable with.

Which would imply that some users had issues getting onto Zoom, the easiest of these systems to join. So why make it harder?

wat? That's a totally-incorrect assumption. Zoom requires installation of software. Jitsi doesn't.

> I've actually just gone off to try out jitsi again (i do actually check to see if it's worth switching platforms) and it turns out it asks me to install an android app too. So Jit.si itself actually needs me to download software on my smartphone. So......

I'd quite like to not have to unexpectedly sacrifice 4 hours of my time finding a bug in the config. Nor do I really want to spend (at least) a weekend to double check all the install/config works correctly to start with.

I'm busy enough with the day job without starting a second one. I admin this voluntarily and I'd rather work smart, not hard.

EDIT: You can see my reply to the parent for user side technical effort. A helpful hint might be to think about this problem in people terms, rather than systems terms.

> My point was that Zoom fits some use cases better, and that seems to be the case more often than not for users with less technical ability than the HN userbase.

Some of our users may be, in the kindest possible way, completely batshit insane with their life falling apart when they first turn up to our meetings.

Meeting hosts [0] can explain Zoom to them in three/four steps and look after them from there with in meeting controls. With Jitsi, they've got to keep asking them to stop unmuting themself because they keep pressing buttons... Which means they have to stop the meeting for 5 minutes, again and again and again.

EDIT for further information / clarity:

Zoom also enables users to chat without any additional steps [1]. With Jitsi you have to create a name to even see the chat. So new users may connect, not hear anything [2] and then just leave and not come back. Zoom, they can see the message we send them and then we can guide them from there.

Then there's the fact that meeting hosts cannot screen share from smartphone with Jitsi -- 90% of our users/hosts are smartphone only [3]. This would require them buying a laptop. Many hosts cannot do this / adds to technical effort.

Then there's the fact that we'd have to type in the name of the Jitsi meeting EXACTLY whenever we want to start the meeting. Hosts would have to get the name of the meeting ID exactly correct every week. To make meeting IDs secure, that'd mean they have to type a complex character sequence out perfectly every day. (Yes they can copypasta, but some aren't even that technically adept).

Then of course there's always the chance someone else uses that meeting ID at the same time by accident! There's no method I saw where you can reserve a Jitsi meeting ID only for our use [4]. Oh, and while I'm here, what about the fact that you cannot schedule a jitsi meeting ID ahead of time? So there's no scheduling a call / meeting available.

I might as well talk about security too -- anyone in a Jitsi meeting can start a live recording [5]. And any participant can just remove and change the meeting password at any time. And no waiting rooms. And once a user is removed, they can just join again -- repeat Zoombombings, woo!

And then this doesn't even begin to cover the fact that hosts need to go through all the steps to set up a meeting [6] every time they start a meeting. Zoom handles all that with the default settings I enable for them as admin.

Some of this can be covered by custom Jitsi server installs. But that introduces way more technical effort on my side and doesn't cover dial in phone options (at least in a simple and forward maintainable way).

I'd rather pay Zoom £20 a month.

====

Addendum: I just tried setting up a password for a meeting and then inviting myself. The password wasn't required to join... Pretty poor!

[0]: not me, I'm admin

[1]: e.g. in the case of buggy audio

[2]: maybe they didn't accept the permissions properly

[3]: tested on latest android app

[4]: I could be wrong, but this is a simple option for Zoom

[5]: An absolute no-no for us.

[6]: set up the password, mute participants to start with, chat with host only (not an option on jitsi), amongst others

Posted in reply to a child comment earlier ^.

When I originally scoped out which platforms fitted our use case best, it was Jitsi vs. Zoom in the end. This was 3 months ago.

We ended up with Zoom for several reasons specific to our use case.

No software is a magic bullet that solves 100% of use cases. This is why competition exists.

Partly, but they also actively go out of their way to disable security mitigations for reasons that are unclear so I’m not all that surprised. On Linux I think they were one simple buffer overflow away from arbitrary code execution, which is all but asking for an attack if you parse data from the network in an unsafe language.

1. Today zoom links load a webpage that hits a local web server which launches the app (after some delay). There has to be a better way. Why do I need an app at all? Yes I know there is a trick to avoid using/installing the app but it’s not full featured.

2. Fans run on high during a simple video conference and my cpu melts during a screen share. Why is GPU acceleration not a thing here?

None of that happens with google meet for example. Most modern CPUs have hardware support for h264/5 encoding decoding. I shouldn’t need to blow my CPU budget to show a video and play some sounds.

Zoom is a shady company that does crap like secretly install a web server on Macs that allows it to reinstall itself once installed. I refuse to install Zoom on any computer. I installed it on my iPad out of necessity where I know it’s in a strict sandbox.

Edit link:

https://www.zdnet.com/article/zoom-defends-use-of-local-web-...

And I hate that Covid means that I am pretty much forced to use have half a dozen each day.

Then, when you can choose which service to use, pick one that is web-first.

I can live with a fat app, but anything that insists on being there and having serious negative trade-offs even when not using it, in my opinion falls under malware.

I hope they all uninstall cleanly after covid.

On my work computer it went from using kind 60% of a core to almost nothing.

I've only ever seen this when explaining to people why Linux appears to be using all their RAM - it caches your disk to make subsequent reads faster, and when an application needs more memory the cache will be evicted immediately and at almost no performance cost.

It's completely insane to suggest the user's RAM is yours to consume. Some people have 64 gb of memory in their desktops, and others have 4gb on their $300 laptop because that's all they could afford, and some have 2gb on their cheap phone.

That's where it's taught I think, and certainly it's the truth in that context. But more than a few times I've encountered it as a defense for stuff like bloated chat programs slurping up gigabytes of RAM.

With respect to hardware diversity, I think part of the problem is most programmers do their development on powerful hardware and become accustomed to it. Certainly nobody wants to sit around for an hour waiting for their build to finish on low-end hardware when a powerful computer, which they or their employer can easily afford, could finish the build in minutes. But because of that, they lose touch with end users who will be running that software on very modest hardware.

Find Ripcord, it is fast and works for Slack and Discord.

Short of that Sandboxie, which has been around for a long time, has more of a restrictions/container type approach.

https://community.sophos.com/products/sandboxie/f/forum/1196...

https://github.com/sandboxie/sandboxie

Also, is it possible to sandbox any app? Say, for example, Zoom.

No vulnerabilities are in production because of buggy code and lack of pre-production quality control. But yes more popularity means more free quality control by third parties. It is a sad reality of "scale first" and "cheapest offer" economies.

But if I'd have to pick one I'd guess Google has the best security analysis track record, anti-China fetish which tops the lack of clue what they are doing with their chat or conferencing products.

Qubes

I immediately shutoff Kazaa and rethought my approach to secure computing at home

These two only failed because Microsoft deliberately killed them. One of these things I will never understand.

That's what Windows 10x is doing. Performance will most likely take a hit.

See also: atlassian, oracle, salesforce, zendesk, etc

Versus, say, Google Hangouts Meet, Facebook, Skype, Telegram, WhatsApp etc.?

I presume the same with telegram.

Skype for business has been deprecated by Microsoft in favour of teams. I use it daily and it's just not that great. It requires a Microsoft subscription.

Google hangouts meet only just became available for everyone to use. Before it required a Google business subscription. It makes my CPU usage max out and cooks my laptop.

Zoom works well with 10s of people in a call, it's easy to use. Breakout rooms is a useful feature.

With COVID so many people are using it not because of a marketing campaign but because it's easy to use.

I think it's like asking "why is a an iPhone better than a Blackberry? They both make calls and send email."

But I think Zoom has built their product to not be "enterprise" which in my opinion is a good thing. As that usually means you need to accept jank.

Of course there are security issues with the software as well.

I haven't used jitsi or uberconference. If you have, tell me why they aren't popular?

Do they do anything that Zoom doesn't?

Edit:Like 6 months or 2 years :shrug:

Does it matter? Shoddy code is shoddy code, no matter how many people run it.

A bad program may only run on one person's machine, but if that machine belongs to the Secretary of Defense, it still matters.