News for hackers. Stuff that matters.

A comment on Two vulnerabilities in Zoom could lead to code execution.

Re:Two vulnerabilities in Zoom could lead to code execution by olliej on Sunday June 07, 2020 @05:55AM (#23446117)
At least they're into regular bad code bugs, rather than intentionally created security holes, including deliberately circumventing browser security restrictions.

So progress?

[ Parent | on HN ]
Re:Two vulnerabilities in Zoom could lead to code execution by scarface74 on Sunday June 07, 2020 @08:07AM (#23446797)
You mean like secretly installing a web server on Macs so that if you uninstall Zoom it reinstalls itself?

https://www.zdnet.com/article/zoom-defends-use-of-local-web-...

[ Parent | on HN ]
Re:Two vulnerabilities in Zoom could lead to code execution by olliej on Sunday June 07, 2020 @04:56PM (#23450729)
That’s what they’ve moved on from - intentionally malicious code to just bad code. Such progress! Much wow!
[ Parent | on HN ]
Re:Two vulnerabilities in Zoom could lead to code execution by snvzz on Monday June 08, 2020 @01:35PM (#23458669)
They've learned about plausible deniability.

At least, if it looks like a vulnerability, they can probably get away with it.

[ Parent | on HN ]
Re:Two vulnerabilities in Zoom could lead to code execution by crazygringo on Sunday June 07, 2020 @08:57AM (#23447006)
No.

Your link is from 2019. GP is referring to how Zoom has (so far) moved on from those kinds of egregious behaviors, so now in June 2020 we're looking at just regular (non-malicious) code vulnerabilities.

[ Parent | on HN ]
Re:Two vulnerabilities in Zoom could lead to code execution by scarface74 on Sunday June 07, 2020 @09:14AM (#23447098)
How can you trust a company with that type of culture? An accidental vulnerability is excusable. They intentionally wrote malware.
[ Parent | on HN ]
Re:Two vulnerabilities in Zoom could lead to code execution by crazygringo on Sunday June 07, 2020 @12:26PM (#23448475)
Why do you think that has anything to do with culture?

They made business decisions that seemed rational at the time, to grow fast at the expense of good security.

Now they're making business decisions that are rational for the current situation -- they've grown hugely, and now have been fixing their reputation for privacy and security.

Culture has nothing to do with it. It's pure business. I trust their profit motive far more than any "culture". And their profit motive now is: do everything to be a trustworthy product. And their actions over the past couple of months have been demonstrating that.

Do you think it's impossible for companies to change? Because a company makes mistakes, they can't ever be trusted again? That doesn't seem very realistic.

[ Parent | on HN ]
Re:Two vulnerabilities in Zoom could lead to code execution by scarface74 on Sunday June 07, 2020 @02:16PM (#23449347)
They made business decisions that seemed rational at the time, to grow fast at the expense of good security.

It seems rational to create malware?

[ Parent | on HN ]
Re:Two vulnerabilities in Zoom could lead to code execution by donarb on Sunday June 07, 2020 @10:32AM (#23447602)
Not much progress at all. They just announced the end-to-end encryption will be a paid for feature. Free users won't get this feature because as CEO Eric Yuan says "Free users for sure we don't want to give that because we also want to work with the FBI, with local law enforcement in case some people use Zoom for a bad purpose".

https://news.ycombinator.com/item?id=23437573

[ Parent | on HN ]