Zoom needs to clean up its privacy act
blogs.harvard.edu
blogs.harvard.edu
- Use the Facebook iOS SDK to measure conversions from app install ads
- Send a list of hashed email addresses to Facebook or other advertisers to do ad re-targeting
- Have Google Analytics on their websites to track where people are visiting their website from, i.e. a click on a Google AdWords ad
While these are all not _ideal_ because _yes_, Google and Facebook use this data for their own purposes as well, it's far from _nefarious_. In fact, it's pretty standard fare. Could Zoom go above and beyond and reject these tools? Yes, they could. Does anyone in practice? No.
If Zoom was selling metadata about their calls, leaking contents of their calls, or themselves served ads – then yes, I'd be concerned. But all indications point to them purchasing ads to further the growth of their business.
I think it is perfectly reasonable to seek guarantees around the usage of the above, more sensitive data (contents of video calls, metadata of video calls, etc.) but on the flip side to imply from their privacy policy that they are sending it to Facebook or that they are "in the advertising business" is jumping the gun a little bit.
Aka "common sense" aka "anything that will fit within the Overton window"
Not to be confused with "decent, moral behavior"
I'm waiting for these conferencing apps to feed into clearview ai.
(And hashed email addresses? Might as well just send the email addresses. Hashing is kind of useless there.)
Hashed contact info is just how Facebook intakes contact information. Makes it harder for them to get the info of non-Facebook users who are patrons of the business. They claim to delete it: https://www.facebook.com/business/help/112061095610075?id=24...
These are closed source, right? How do you know this feature works?
I open the .pkg, click Continue so it can run its script, then a second later Installer quits and the app launches. What?!
Turns out, Zoom installs the entire app in the 'preinstall' script of the installer package! Inside there's a copy of '7z', and the app is extracted with that. The preinstall script is littered with typos and poor grammar.
I'm not one of those people who thinks that Apple is going to force all Mac software to come through the App Store, but when I see stuff this stupid...I start to wonder.
So I can totally understand why they would want to use 7zip to shave kilobytes off the download size.
Also packages allow for easier deployment rather than dmg's.
Par for the course with Zoom, so it seems.
NVM I decided to inspect the package with `pkgutil`
Here's the offending code
```################################### function install_app_to_path(){ #path=$1 InstallPath="$1/.zoomus_"$(date)"" mkdir -p "$InstallPath" mkdir -p "$InstallPath/Frameworks" if [[ $? != 0 ]] ; then rm -rf "$InstallPath" return 1 fi
if [[ -d "$1/zoom.us.app" ]] ; then
rm -f "$1/zoom.us.app/Contents/Info.plist"
mv "$1/zoom.us.app/Contents" "$InstallPath/trash"
fi
if [[ $? != 0 ]] ; then
rm -rf "$InstallPath"
return 4
fi
rm -rf "$1/zoom.us.app"
if [[ $? != 0 ]] ; then
rm -rf "$InstallPath"
return 4
fi
mdfind 'kMDItemCFBundleIdentifier == "us.zoom.xos"'> .zoom.us.applist.txt
echo "["$(date)"]un7z zm.7z =================================" >>"$LOG_PATH"
if [[ -f res.7z ]] ; then
./7zr x -mmt ./res.7z -o"$InstallPath/Frameworks"&
fi
if [[ -f resReitna.7z ]] ; then
./7zr x -mmt ./resReitna.7z -o"$InstallPath/Frameworks"&
fi
if [[ -f bundles.7z ]] ; then
./7zr x -mmt ./bundles.7z -o"$InstallPath/Frameworks"&
fi
un7zresult=$(./7zr x -mmt ./zm.7z -o"$InstallPath" 2>>"$LOG_PATH")
ret=$?
echo "["$(date)"]check un7z return:$ret, $un7zresult">>"$LOG_PATH"
wait
echo "["$(date)"]un7z all finished">>"$LOG_PATH"
if [[ $ret != 0 ]] ; then
rm -rf "$InstallPath"
return 3
fi
mv "$InstallPath/Frameworks/"* "$InstallPath/zoom.us.app/Contents/Frameworks">>"$LOG_PATH"
mv "$InstallPath/zoom.us.app" "$1" >>"$LOG_PATH"
if [[ $? != 0 ]] ; then
rm -rf "$InstallPath"
return 1
fi
if [[ "$APP_PATH" == "$GLOBAL_APP_PATH" ]] ; then
chmod -R 775 "$APP_PATH"
chown -R :admin "$APP_PATH"
fi
echo "["$(date)"]mv $InstallPath/zoom.us.app into $1">>"$LOG_PATH"
rm -rf "$InstallPath"&
return 0Honestly zoom is something that I would never let near a personal computer. What really surprised me is that there’s a “zoomgov.” (a friend at a defense contractor showed me) Either our government is enjoying the benefits of being able to force companies to be audited because of defense budgets or things have become way more relaxed than they should be. Judging by our “stockpiles” and inability to get critical equipment I’m guessing the second one.
...I was about to write a reply saying "well in that case I don't understand what the GP is complaining about", but then I opened up the installer again.
I didn't fully take in what the parent was saying. Zoom is completely short-circuiting the normal macOS package install flow. You click continue once to acknowledge that "this package will run a program to determine if the software can be installed", and then Zoom is suddenly installed and the installer exits.
I can understand why they did it, but it's not good.
Although, Apple deserves some blame here. Firstly because their non-app-store software install flow has been screwed up since the release of Lion, and secondly because why can't you use Installer's "Show Files" option before the preinstall step?
1. You download an installer.
2. You activate that installer.
3. Your system tells you that the installer can run some code.
4. You agree to the installer running some code.
5. The installer installs some software, via the code that you said the installer could run.
Seems perfectly acceptable to me. If you literally cannot open up the archive file to inspect its contents without running some code inside it, that's not Zoom's problem. It's just a really stupid decision on the part of Apple.
The message reads "this package will run a program _to determine if the software can be installed_". Old iWork updates used this to see you had a previous version of iWork on your computer. nVidia's Web Drivers used it to check if your Mac had an nVidia card. No other macOS pkg that I'm aware of makes actual changes made to your system during this step. That's not what the user agreed to.
Behind the consent message is a grayed-out "next" button that you never get to click.
I suppose this system was ripe for abuse, but that doesn't excuse the people who abuse it.
Pre-install scripts are only supposed to do things like check if you have prerequisites installed, eg if your app requires some version of Python or whatever.
Instead they are abusing that to just install everything immediately.
There is literally no reason for it beyond saving one or two clicks.
Whenever I have been told that I have a meeting coming up with some kind of conferencing software that I don't have installed, I immediately install it. I don't wait until 3 minutes before the call to try and install. All kinds of things could happen, such as incompatibilities or missing passcodes.
I do think on macOS the average user doesn't understand DMG files, run apps from inside the DMG instead of copying them to /Applications and deleting the disk image. My guess is that most people install Zoom after a meeting has started and this was the quickest, fewest dialog method of getting it up and running.
First, there's nothing wrong with that.
Also, some apps display a message asking to be moved to /Applications when launched from a DMG.
Sure, you can technically run .app from most places. It becomes problematic in that you can't write to that directory or self update the app if it's still in the DMG. If you reboot you have to know to remount before launching. Not having it in /Applications also becomes a mess if you're in a multi-user environment.
> Also, some apps display a message asking to be moved to /Applications when launched from a DMG.
This is the kind of friction and extra dialog boxes I'm sure they were avoiding.
Personally, I hate pkg files. I wish macOS had a better flow for unsavvy users to deal with DMG and app files.
Very few people cared when I commented this https://news.ycombinator.com/item?id=20398084
Suffice it to say, I no longer trust Zoom to be running in my regular user account. I have a separate user on my Mac to isolate it. If you have the means, you might even consider a spare computer or a VM to run Zoom.
Even their iOS/iPadOS app is annoying, because the first time you open it and sign in, it pops 3 (!) permission dialogs (Calendar, Notifications, and TouchID/FaceID). Way too aggressive IMO.
Now, if only they'd make a Mac App Store version of Zoom. I'd be so happy...
So for now Skype and MS Teams works fine, or at least fine enough that I don't bother with Zoom. Which brings me to a side question: what is the value proposition for Zoom? What does their product do so much better than the others that I'd put up with this shit? Why am I hearing the hell out of it lately? Outstanding PR department?
EDIT: thanks for your answers to “why use it, then?” Because “it just works” seems to be the summary, which hoo boy, one cannot say about a lot of the competition.
I agree with your sentiment though - it makes me angry that they're selling my personal data. But sadly I don't think that any companies will voluntarily be non-skeezy...we really need laws and regulations in this space. I don't trust capitalism to take care of my privacy. If companies can get more money without breaking the law, they will absolutely do so.
Meanwhile, my company's VOIP acting funny. Conference calls not working. My wife was having issues with skype.
Yes, there are alternatives out there, but i'm yet to see one that is easy to use and reliable in the same way.
Good PR helps too, I suppose.
PS- I hate misuse of my data as much as the next person.
I'll share my perspective as an academic. Many of us have adopted Zoom, practically overnight, for our teaching, for one-on-one meetings with students, and even for conferences [1].
The answer is: It just works. It's easy. It does what we want it to, with a minimum of fuss.
As someone who now has a whole bunch of unanticipated shit to deal with, this is one less thing to worry about.
I definitely share your objection in principle. If this situation continues long into the future (a terrifying thought), then perhaps I'll revisit my choice of software. But in the short term, to be honest, I don't much care.
And I should add that I'm trying out MS Teams as an alternative. After six days, and multiple e-mails back and forth with our IT department, I think I've almost got it set up properly.
Your answer sort of reads as if the choice of technology is the only friction people are currently dealing with. The situation isn't easy, even using some easy to use technology like zoom. Adding friction will only make things harder for people doing their best in already hard circumstances. It may well exceed their mental budget for friction.
I wish widely deployed privacy-respecting solutions were already deployed at scale, people trained in their use and a suitable curriculum available. But that's not where we are and putting more load on already well loaded people will not improve the situation.
It asks the question "What is the point of a principle?"
I dont think calling privacy a principle is true if you are willing to give it up for something that "just works" - I believe covid is likely one of the biggest problems in the modern age, but during times of hardship we need to cling ever harder to our principles, or consider that maybe it isn't nearly as important to us as we thought.
Preface or not, it still reads like that. You're extolling one principle. I entirely agree that privacy is important but should be upheld. But there are other conflicting principles at work here - the list here is in no way complete.
* The right to privacy.
* The right of pupils to receive an education
* The right of teachers to limit the amount of work and energy they need to put into their work.
* The right of teachers and pupils (and the general public) to stay at home and evade infection.
And that's why your absolutism on one principle to me still reads flip - or at least ill considered - even if you preface it with "I don't want to be flip."
* The right of teachers to monitor their students activities during class.
(Also: Your list is unreadable due to the use of code no-wrap formatting. Please don't use code indents for blockquoted normal text.)
We haven't seen a Zoom log found in an open S3 bucket yet, or a leak via fb, but experience says that it is only a matter of time.
So if you're going to mandate Zoom, own the risk. Mitigation is possible: provide recorded streams for secured download (if safe/ethical/notified to record other participants!); provide a work laptop with a non-identifying config instead of a BYOD; many other options.
If you are going that way then likewise, there is always someone somewhere could die because the software doesn't work because they prioritize privacy.
Beside, The reason we have growing acceptance for the LGBT is because of the openness and transparency. That won't happen if we have perfect privacy.
Yes is true that leak is only matter of time, so its even more infeasible to maintain privacy. The solution should be to assume information is public as much as we can and fix the issue that arise from that.
If you could post your real name, address, phone number, email, sexual orientation, religion, employment status, performance review, salary, hobbies, political viewpoints etc we can get started processing your revocation of privacy.
Oh you didn't realise your boss was having meetings with HR over Zoom? Sorry, we can't have different rules for some.
Oh and you'll start seeing ads for '5 step sobreity' now since we see you were in the local AA Zoom. Sorry about not getting that new job -- that company ticked the 'no addicts' flag in the selection matrix, and, well, the job market is kinda competitive now.
Eventually yes, I would prefer that I don't have to keep secret of all of those information but I can't because not everyone is.
>Oh and you'll start seeing ads for '5 step sobreity' now since we see you were in the local AA Zoom. Sorry about not getting that new job -- that company ticked the 'no addicts' flag in the selection matrix, and, well, the job market is kinda competitive now
If a company choose not to hire addict than its their choice, its their lost.
I have actually voluntarily shared pretty much everything on your list publicly at some point. Even then the important part is that it was my choice to do so, and there’s still a number of things I will not freely share.
The consequence of getting on a school bus can be life or death. The consequence of eating a peanut butter sandwich can be life or death.
If you’re a medical professional or psychiatrist, maybe you shouldn’t use zoom due it’s privacy record. But if you’re teaching a lecture on linked lists to your class of 30 kids, death via persecution should probably be very low on your considerations when choosing video conference tech.
Frankly I find your comment dismissive of the real threats faced by women and minorities.
I know math lectures don't seem a hot spot, but it's a slippery slope of adoption, and you might be surprised about the depth of harassment problems in the math community.
Or maybe people has different principle.
Yes, a rational person does. You're thinking of dogma. People don't give up their dogmas when the costs outweigh its reasonable benefits because holding onto their belief system is practically infinitely valuable.
Dogmas are hard boundaries. Principles are guiding factors. Sacrificing privacy as a principle in the midst of a global pandemic is perfectly fine in most cases. It's still a guiding factor, but it's of lower priority than competing interests.
I am prioritizing. During the present COVID-19 situation, my top two priorities are (1) maintain my health, including my mental health, and refrain from posing a health hazard to others, and (2) maintain my relationships with my students, colleagues, and collaborators.
As I see it, if I give some skeezy private company some personal information by accident, then I am making a personal sacrifice, and not all that big of one. I'm trying to worry about my duties to others first.
You're normalizing it and making your students use it though, so it's really not "it affects me, but I don't care enough", it affects others as well. And let's not kid ourselves: once it's established, nobody will switch to something else, because they'd have to explain and guide everyone they want to talk to to install another app etc.
Your second point I disagree with; I think if people raise objections, encourage people to switch, and volunteer to shepherd others through the technical details -- then people will be agreeable, and we'll see a shift which will gradually become pervasive.
This doesn't square with any experience I've ever had trying to get $alternative_technology adopted because of $principle in favor of $default_thing, and from what I've gleaned talking to others, and reading the experiences of others online, the problem isn't me.
Maybe post Cambridge Analytica the world has changed -- I at least don't get looked at like I have three heads when I tell people I'm not on Facebook anymore -- but if folks are still responding to complaints about privacy issues like this with what amounts to "meh, don't have the energy" then I'm skeptical. If zoom becomes "the standard," I don't think the inertia will be much easier to overcome.
It can change rapidly in small communities, e.g. you getting everyone in your department together, deciding on $goodAlternative and using that whenever possible (in addition to Zoom, because you'll still have to communicate with the outside world). But at large?
As soon as something goes wrong with your solution - everyone goes, why aren't we using zoom. Literally totally non-techies - that will be their first bit of feedback (I tried to go with google hangouts).
I live in France. Overnight schools were closed and the existing school platforms are a joke.
Beside the fact that they crashed, there is no interactivity built in.
So as a parent of two children I would have been delighted if the teachers switched immediately to Zoom or Discord and I truly do not give a fuck (not that I do not care, I do not give a fuck) about privacy and whatnot when it comes to middle age history or derivatives.
This is this, or me having two jobs.
So except if the software keeps on spying after it is switched off (which would be unacceptable) they can use Zoom or whatever if the teaching process is maintained.
If the teacher asked me to install The Catholic Video Conferencing System my only question would be where to get the msi from. (again provided that there is no spying afterwards)
This is really kind of funny, because this exact thing happened literally less than a year ago. It was technically a vulnerability, but they refused to see it as such and fix it until it was disclosed publicly and they had a wave of negative PR. They literally allowed anyone to connect to the webcam on your computer through an always-on server which remained installed after you removed Zoom from your computer. https://medium.com/bugbountywriteup/zoom-zero-day-4-million-...
I can't believe everyone has forgotten this quickly. Zoom is not a trustworthy company.
What they did is a shame. I do not know yet whether to attribute it to malice, sloppiness, immaturity, or a combination of the above.
If you're a Comp Sci or Engineering prof you really have an obligation to try harder. You have the capability to explain mitigation techniques (virtual machines, sandboxing, using temporary email addresses, VPNs).
Longer term I think we will see a host of Zoom competitors, because really there is nothing special in the client. Hangouts in particular could easily eclipse it with some work.
Also, I think the grid of faces approach is just awful. Many people have been working on VR meeting systems which have significant advantages for multiperson communication (i.e. discussion vs broadcast). Lecture/theatre VTC (which provides an aggregated feedback signal to the presenter) is completely unmet by Zoom. So once we're past the hump the field will broaden, and at that point the privacy requirements have to be enforced rigourously.
Then why hasn't it, despite far more work and funding than Zoom, for over a decade? This is a "I could have invented Facebook" comment. Things are harder than you suggest.
Also I've done 300+ participant A/V conferencing systems, it isn't the client part that is hard, its the authentication, directory and latency that becomes difficult, and google already has that pretty well sorted.
Is this actually better from a privacy perspective? Sounds like abandoning the frying pan for the fire...
From a technical perspective I don't think anything groundbreaking is required, it just wasn't a market segment earning money before now, because why not just walk down the hall, or have a conference etc? Noone is saying a Zoom meeting can replace that, it is just a stop gap.
Both in high school and college I used PLENTY of stuff that I didn't want to and was never provided "alternatives" if I didn't consent. Seriously, endpoint protection products centrally controlled with total system access control are not uncommon in these settings.
You are claiming I can opt out of all of this if it invades my privacy?
The school had a third party vendor that tracked every keycard access to every lock on campus - I'd def like to opt out of that!
Of course, if the schooling is voluntary; either private K-12 or any collegiate level, then you just have to play by their rules or go home. Someone could definitely bring the case against a state K-12 requiring Zoom use though, were they properly paranoid, motivated, and funded.
You are, of course, welcome to opt out, but there is -- as you suggest -- no requirement for a school or employer to provide an alternative.
Accept it, and you'll be happier.
I’m not casting any aspersions here, I’m only interested in comparing notes with a fellow teacher.
Safeguarding is a term used in the United Kingdom and Ireland to denote measures to protect the health, well-being and human rights of individuals, which allow people — especially children, young people and vulnerable adults — to live free from abuse, harm and neglect.
In undergrad 1 to 1 also happens, but they are less frequent.
> Mathematics (assistant) professor at the University of South Carolina.
1 to 1's are totally common and accepted in a university setting. You're generally supposed to leave your office door open (when having them in person), but otherwise this doesn't raise any eyebrows.
In general it's not considered a risk because their parents are usually nearby if not actually on the call.
I guess I'd like to know the details of how its easier than the other of myriad of products on the market for you?
At my company we use Slack Video calls, WebEx, and Zoom, and they seem as identical as each other (I'd argue Slack is easiest since we're all logged into it all the time, but that's us).
Slack removed screen sharing, which means I can't easily do screen sharing and debugging on the same call.
WebEx and G2M are much less easy to use.
It used to be a feature, and then they removed it.
webex quality is very bad for 35+ active participants.
Teams etc. have very bad quality during this crisis induced load.
lots of the solutions currently are barely working (google with only bad quality, others don’t have working phone call in etc.
Zoom just keeps working, for everyone.
to put this into perspective: that’s mostly for uses cases beyond 3ppl or 2+ countries, so i’d guess 90% of the users of all tools are unaffected.
Our Zoom THM with 130 participants ran without any issues whatsoever. I'm stunned how flawlessly they seam to scale. I want to work with the people responsible for this tbh.
We regularly have milestone meetings at a custommer with 300 people joining with the normal setup where everyone can join the conversation, never had any problems with zoom.
let’s see how they exploit it financially after so much free marketing. no evil or not ;)
So sure, if you're all already in slack it's ok. But my five year old niece isn't in a slack team already, nor my in-laws.
Or you know - send over my zoom meeting room number - and done.
Zoom is well known, so people are likely to try it early in the process. If it works they may choose to move on to other things. This may not be the perfect process in the abstract, but in reality it's practical.
I haven't comparison shopped yet. And, for that matter, I haven't initiated any Zoom meeting myself, except once when someone else requested I do so. (I used Blackboard to meet with my classes.) I just noticed that it's been popular with others, and I've gotten it up and running with no effort.
I am trying out MS Teams, but it's a pain to setup. Multiple emails back and forth to tech support, and apparently I have to go in and manually add every person I want included. From what I can tell, it seems to be designed around a rather elaborate setup, in a situation where you consistently communicate with the same handful of people.
With Zoom, it's "click on this link". You don't have to have configured anything in advance. Especially useful when you want your meetings to be open.
As an example, you can now watch the Number Theory Seminar at MIT, live:
(The password is there to prevent trolling, but there's no serious need for security.)
Zoom seems VERY focused on making stuff easy to use.
They clearly are doing things like installing in user folders etc to get around organization "protections". Same thing with the crazy web server launcher. Yes - creates privacy / security risks but also made things marginally easier. Same with the Facebook SDK integration etc. They are going for ease of use FIRST.
HN is treating zoom as if it's some devil software. Part of the REASON for it's success (vs the fully end to end encrypted offerings etc) is because it DOESN'T emphasize security / privacy, it can be installed in a shadow IT manner etc.
That is why it is successful.
What makes you so sure?
You can set your own meeting room to be join-able BY ANYONE with an ID that DOES NOT CHANGE. Terrible security - great convenience.
Business and educators get feedback if students etc are using other programs other than zoom while on call. TERRIBLE for privacy (zoom tracking which windows are foreground etc) - nice convenience for teachers and bosses who like this.
At every turn, zoom has emphasized things like this.
This sounds right to me.
Last week on Zoom, I attended an online conference (https://www.daniellitt.com/agonize/), and participated in a D+D game. Privacy and security weren't priorities. (Indeed, complete video of the conference has since been posted.)
That said, there have been problems, see for example here:
https://www.insidehighered.com/news/2020/03/26/zoombombers-d...
Some random trolls apparently joined a Zoom class and made jackasses of themselves.
Privacy is not a synonym for security. It's not even necessarily a requirement for good security.
Yes unfortunately. Mouses would be better off caring for mouse traps.
> That is why it is successful.
Successful for them but not for us as a community in the long run.
I only started using Zoom now and it solves a lot of my problems: virtual backgrounds while talking to students in my bedroom, recording my lectures, handling large live streams (50+ people), painless set up for non-tech-savvy users.
The only problem I had is that it would corrupt sound from my mic about every hour in a 4 hour stream.
They will be successful, but in part because other chose not to be.
I've actually found the opposite to be true. Google Meet is an example of a product that just works. Zoom, by contrast, pushes you very heavily into downloading and installing an application on every device you want to use it with, and provides a secondary degraded experience in the browser if you find the right link to use it (which you have to do EVERY SINGLE TIME; there doesn't seem to be a way to permanently opt out of the "install this application" nag flow).
Wonder why this is apparently not working? I don't pay for gmail. I'm not using it in a domain.
Unfortunately if you go with the suggested methods for using zoom, it is very easy to join a meeting
Of course "it just works" is a subjective, personal opinion.
Outside the one or two time app install (depending how many devices the user has) Zoom actually has everything you need to get a meeting done. Need a multi user whiteboard? There. Need to have someone control someone elses stuff? There. Need to hold a large meeting and have one at a time raise hand questions? There. Most importantly these don't get in the way of "need to just talk with someone else" being there and just working as well.
No meeting app is perfect for everybody but Meet lacks a lot of flexibility to get it's simplicity and it's not all that much simpler than Zoom for it.
We have Hangouts Meet free at work, available for every single meeting with a single click. Zoom is also quietly available, but we're disincentivized to use it, because the company has to pay extra. We have to jump through hoops to get access. Yet since the COVID WFH revolution, Zoom is becoming more and more widespread. Because, as a VC solution, it just works, and works noticeably better than Hangouts Meet.
"Starting this week, we will begin rolling out free access to our advanced Hangouts Meet video-conferencing capabilities to all G Suite and G Suite for Education customers globally including:
- Larger meetings, for up to 250 participants per call
- Live streaming for up to 100,000 viewers within a domain
- The ability to record meetings and save them to Google Drive " [1]
Zoom definitely has better crowd control (for lack of a better term) than Meet does. Meet does have some relatively unused but helpful features though like the questions that you can ask as an audience member and upvote others' questions. Can be very helpful in a lecture.
[1]: https://cloud.google.com/blog/products/g-suite/helping-busin...
Edit. Add reference, quote.
I also think accounts are a friction. Even though we all used Google services, with Zoom if I needed to hop onto my phone so I could listen in while running an errand I would have needed to authenticate if I was using Meet. I also don't think I've ever been in a Google video chat with more than 2 people. With Zoom we did company meetings without issue.
I wrote a browser plugin to do this:
Anyway, thanks for the link. It didn't even occur to me to look for something like that.
I think the real reason is "it's just what everyone else was doing." All of these apps "just work," as someone who has used a veritable gaggle let me tell you there's scarce difference between them. Except zoom makes it more difficult to join without the app (others work in the browser outright, zoom tricks you into installing).
Zoom I think just happens to be one of the trendiest. But with this kind of behavior there's really no reason to use them.
I can't speak for others. But for me, using Zoom is really because it worked better than everything else I'd tried (Skype, Google Hangouts, WebEx, rolling my own SIP server). That was parts: Linux software reliability (WebEx, Skype), limits on the number of people that could join meetings (Hangouts), and effort to talk my collaborators into installing new software (SIP+Jitsi). A bonus is that my employer had an institutional Zoom account. I've been happily using Zoom for 2-3 years now. I'm unhappy about these privacy issues that are being discovered/discussed now and I kinda feel like I should have looked into it. I'm sure there is a bandwagon effect happening, but there was also a real component of it working better than other solutions.
At my new company they wanted to pay a license to use zoom. I asked why don't we just use meetings for free? The answer was it makes us look professional. That's where zoom is. There are dozens are alternatives.
What you're saying is basically a form of 'works on my machine'.
Zoom, Facebook, Microsoft, and Google could all learn a thing or two from Apple with regard to privacy policy.
Honestly, I didn't know that there was in-browser capabilities. The last time I used jitsi was via the java desktop client, probably 3-4 years ago. It was a year or so later that I started using Zoom, so I didn't revisit jitsi.
I'm sure part of this is due to it being a native app.
Once a user is over the hiccup of "download and install this," being able to hop into a call immediately without much mucking about with audio and video settings seems consistently better with Zoom.
We were all over the world and using Mac/Win/Linux. So latency was high and bandwidth was often narrow. We also did company meetings every month or so. We pushed in a bunch of different directions. Often apps are only good at one or two of these scenarios, but Zoom was good enough at all of them.
I had no clue until this week there was a web version, but after using all of the others I'm glad it heavily prefers a standalone app. I do wish they had less scummy practices or there were better alternatives.
for me, i think this is key. I've used skype, hangouts, and gotomeeting over the years. only zoom works this well, multi-platform, including my fave, linux, in all sorts of conditions.
i wish this wasn’t so, and that we had good cross-platform solutions. :(
Do the students not care?
I use Teams at work and would say it is comparable to Zoom in terms of AV quality (Microsoft owns both Skype and Teams portfolios, but Teams is built on a modern codebase that runs on different, markedly superior infra than Skype). Unfortunately Teams only works in the enterprise (O365), and it is still fairly new so it doesn't have a lot of the collab functionality like whiteboarding and breakout rooms that Zoom has.
Privacy issues aside, Zoom really is a better product. People are more forgiving of a product's peccadillos when it just works.
My company's virtual meeting solutions are a mess; it's the one really messy area in our tooling. For the longest time we had GoTo, but then the dev team specifically also had hipchat for Slack-like interactions. Then hipchat went away, and for some reason the org took that as a cue to do an org-wide rollout of MS Teams, with no approval for us to use Slack. Somewhere along the way certain people somehow acquired Zoom licenses and started using those. Then just about two weeks ago the whole org was told to switch to Zoom, but now not enough people have licenses and all the old GoTo licenses are kaput.
Anyways, the reason I have heard various people from the business side give for why they like Zoom is "GoTo was too hard to use." I don't really see that, and I also wonder if there's some sort of 'FOMO' going on. A couple big vendors we interact with use Zoom, Zoom is big in the news currently -- "everybody uses Zoom!" I do also think it's maybe a bit cheaper at enterprise scale.
I don't mind Zoom from a UX/call quality perspective. I think Alt-A to unmute is super unintuitive but that's a very minor quibble, and for all I know shortcuts are customizable. I am, however, very discouraged by Zoom's privacy story as we're discussing here.
---
As my own side note, I am generally on board with almost everything MS has been doing lately -- we're mostly a MS shop as they help us with pricing, given we're a nonprofit, while AWS told us 'no chance' -- but Teams has to be the single buggiest MS product I've ever used. Just now, over the past month or so, I've noticed it very slowly improving. But for the first year of our usage, we experienced constant issues. Dropped calls, silent crashes, daily sync failures. My favorite one was, every time I would shut down Teams, it would relaunch itself a few seconds later with a message saying "sorry, Teams has crashed, we're recovering." Apparently every time the program received a shutdown msg it just assumed "oops, another crash."
I've been doing videoconferencing for over 30 years (Yes, they had it back then -we used PictureTel systems, over ISDN).
I regularly participate in Zoom meetings with 20 or more attendees. I know of ones that have over 400.
An amazing thing to me, is that technophobes can pick up on it very easily. Very little of that pre-meeting "Mute your mike!", "Can you hear me?", "Whose dog is that?", tons of texts, asking for help, etc, stuff.
Skype is very bad for more than a small handful of attendees.
WebEx and GoToMeeting are OK, I guess, and I've heard good things about BlueJeans.
But Zoom is what I use, and Zoom is very popular with people that suddenly need to gather, and can't do so, physically.
GoToMeeting has had a banner up for the past few days asking people not to dial in on time for their meetings, because they can't handle the current load. My company uses GTM for everything, but there have been problems. We'll probably switch to Zoom.
FaceTime is the only serious competitor I can think of that's able to deliver as quality of a call experience in a 1:1 setting with non-technical participants, but it's inaccessible on Windows/Android for starters, and lacks the presentation chops to be used in a business setting.
Hard to justify moving from zoom to ms teams when Microsoft have shown they don’t care about privacy either.
Personally I haven't seen many people offer up alternatives that are clear winners. They all have tradeoffs. Since there's tradeoffs I have a hard time moving people to some other direction. If I could says, "Oh Zoom is nice, but Schmooz is the best!" I know people who'd make the move. Even if it's paid.
Skype is terrible some days. Google hangouts is OK. Cisco Webx is dead in the water every time I have tried to use it.
Maybe I just haven't used Zoom enough as the other two do have good days and bad days.
If you don't want a third party getting your contact information, then use a private solution that's actually private. Jitsi and Matrix are open source solutions that both support video conferencing.
Does Zoom have ads? I haven't seen any. I believe all of the ad tracking is for the reverse: Zoom wants to see if their own advertising is effective. For example, if they buy an ad on Facebook that you saw and then you install the app, they can attribute the install to that ad and measure ROI.
Delete according to world-view.
I am using it in chromium on linux, and I can tell you it does not just work. The audio is really really shit (constant crackling). I'm basically unable to attend meetings on zoom. Luckily most of them are in google meet which works fine in a browser.
It seems that Zoom is the only popular videoconferencing software these days that allows you to disable all the postprocessing on the audio signal (echo cancellation, noise reduction, etc) through advanced settings. This postprocessing is very useful for /conversation/ meetings among many people with bad audio setups, but for two musicians and music signals, the postprocessing is highly detrimental, causing strange audio artifacts and causing instruments to drop out sporadically.
(It seems like there would be a market for videoconferencing software optimized for musicians, where the audio signal is sent at higher quality, given higher priority, and not postprocessed in detrimental ways. And without all the privacy concerns.)
It only makes sense if you make the unsupported leap in logic that says that the cash price is itself promise to not use analytics. But you are willing to accept $0 adalytics-supported products, and FOSS exists and some has adalytics and some doesnt, showing that $0 is not any kind of meaningful boundary.
For me, it's one of the few video chat clients that works well in Linux. Skype may or may not work depending on the version and whether or not Microsoft supports the Linux client. And I have no idea whether MS teams works at all in Linux.
Energy consumption. Half hour hangouts drains 30% of battery 3 hours zoom is roughly 5-10%. UX and performance the two major factors why we chose Zoom.
You know, even two hours ago I'd have agreed with you, but my thinking is evolving.
It's pretty clear from responses in this thread that there is a quality difference between Zoom and Hangouts/Slack/Teams/etc, at least under certain circumstances. In addition, anecdotal reports are that if you do insist on joining Zoom via a web browser (even though their user flow really pushes you not to), Zoom's quality goes down a lot.
So perhaps the reason Zoom is superior is because of its native app. Whereas Slack and Teams's apps are just Electron clients that use WebRTC, Zoom is doing something truly custom. It seems to be paying dividends.
Not everything has to run in a web browser.
Very true, and not everything should run in a web browser.
But if something is going to run outside the browser, I would like some explanation of why.
Everyone I know has switched to Zoom. It's a clear improvement in a technical sense than all the existing options out there. We're trying to do our jobs, not make a statement and end up embarrassing ourselves professionally.
So no Zoom does not have to clean up its privacy act. Other companies need to improve their software on a technical level to be more reliable and be more optimized. It's ridiculous that companies who supposedly have amazing developers like Google, Slack, Microsoft, Facebook, can't even do teleconferencing well.
PS: You don't have to download a program -- it has an online version.
They push their client so hard it's not at all surprising OP thought it was required. I would have assumed as much if I hadn't read otherwise. They don't even show you the link to join via web until after you've told them that the download isn't working.
And given what I'm reading about the quality of their web client, there may be a reason they're so pushy...
I think we can cut them some slack for now as they are under more pressure then many other tech companies. They managed to make a great product - so presumably they'll be able to build the right processes for the company itself soon too.
They will never not do that. Paying customer or not, no business is ever going to say "let's give up a huge amount of revenue so we can avoid invading people's privacy and annoying them with ads they don't want to see". To do so would be to miss an opportunity to make even more money.
The fact you're a paying customer also implies you have disposable income and you're willing to spend it. Ironically, paying money to avoid advertising makes your attention even more valuable to advertisers.
The only way they'll stop advertising is if it's not profitable. The only solution is to block all ads and reduce their return on investment as much as possible.
Some companies do this and capitalize on it by advertising it.
Sadly, this happens everywhere. Verizon and ATT? Selling your location and data usage patterns for years.
Bank accounts and credit cards? Selling your purchase patterns for decades.
Why would Zoom care about their privacy issues if they're doing so well off? Seems like that's a good amount of positive reinforcement that their current approach is the right one to them. Maybe they'll lose a few thousand customers because of it, but given what I'm sure was a huge increase in the past few weeks, why would it be something they're concerned about?
The question is "why should Zoom leadership care about the recent privacy concerns if the vast majority of their customers don't care?"
Their stock is up over 6% today while the market is down 4% (volatility caveats here obviously). So far the privacy concerns don't seem to be impacting the companies short or long term prospects, so I wouldn't expect the company to do the right thing.
Hoping zoom and other companies prioritize the public good over profits is foolish, and the solution is to align profits with the public good.
It's a lot like someone complaining about Trump being elected, and you respond with "Yeah, but we live in a Democracy". It's not a very helpful comment, and it doesn't get us anywhere except to keep us in the exact same place we are today.
>It's not a very helpful comment
I would think understanding the problem would be the first step to solving it. I'm not sitting here pretending I have all the answers. I saw an opportunity to shed some light on the situation so I commented. It seems weird to me that your critical of me for not contributing thoughts related directly to a solution, when you haven't contributed any thoughts about a solution either.
To each their own I suppose. But consider me thoroughly uninterested in discussing this further, which, seems to be what you wanted from me anyway.
With our own product ZeroTier we get maybe 1-2 questions a year about privacy and so far only a few enterprise customers have even asked about the security of encryption and authentication. "It's encrypted" is good enough for 99.9% of the market. Encrypted with what? A cereal box cipher? Nobody cares.
What do people care about? In my experience its ease of use, ease of use, ease of use, ease of use, and ease of use, in no particular order. An app that's a privacy and security dumpster fire but is very easy to set up and use will win hands down over a better engineered one that requires even one or two more steps to set up.
Might be because our clients are banks but they really care about this stuff.
It's why your banker might use their cell phone for a zoom client when everyone else is on a computer - their work computer is locked down. Govt employees often the same way. You'll notice they are doing the phone call in or phone client vs their computer.
Lot's of companies, zoom included, get in through the user side not the big webex / cisco type sales process.
It's very very hard to lock down a network without drastically impacting productivity, especially if you have any kind of science, design, or development going on.
I kid you not - obviously they had a deal on faxing for like 50% off, but it was still SUPER timeconsuming and pretty expensive.
Anyways, I configured one of their state of the art copiers to allow them to securely scan to users local folders. I set permissions dropbox style (upload, list but no read / download / delete). It was like I was a god briefly. Then someone in IT found out and the party ended big time.
Realize this isn't that long ago - we are talking some orgs / IT departments are SERIOUSLY retro. I could tell many funny stories (and some sad ones) about folks working around the IT department.
Another common IT workaround was that if a device was not on approved list (basically everything except some junky low bid stuff and definitely no no macs / no ipads) and you had a need (ie marketing / media department wanted to do something with kids shooting and editing video as a feel good, and ipads were great for that and the offical machines sucked) is they would hire a consultant to help them edit, and then put a procurement for the equipment through the consulting bill. Consultant got to mark it all up, but it didn't have to go through the IT purchasing process where ipad's were banned. Was time consuming but I saw it work.
Anyways, I know EXACTLY the type of org who buys these expensive video conferencing systems that fall over when you need them!
Why would people ask you that? You already put the answers in the public documentation.
Slack's business model [1] is storing all history and charging for access for it. Nothing transient about that.
[1] https://en.wikipedia.org/wiki/Slack_(software)#Business_mode...
On the free tier it's still there, on their servers.
Zoom's engineering team is based in China - the product is primarily built out of there. [1]
What guarantee is there that the CCP is not intercepting/backdooring all video communications? Especially in current situations, where so much sensitive information is being discussed via Zoom?
[1] https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...
Surveillance prospects, doesn't matter where they originate - US or China or Country X - need to be discussed and examined. But apparently, saying anything against China on HN is an automatic ban for creating a flame war. We've become too soft. Obviously personal attacks and racism is not tolerable. But, I would personally (some may disagree) say that we should also criticize bad parts of culture too...that's for another day or a different forum.
Can we just get past the my country your country bullshit on HN and talk about privacy implications especially from the world's largest surveillance network? It is one thing to be spied upon for advertisement tracking, an entirely another to be spied upon by a brutal authoritarian government. Fearlessly criticizing CCP or the NSA, or Israeli intelligence agency or whatever... should be one of the most important things to talk about on "Hacker" news forum.
I am gonna fire off some anon emails to WSJ/NYTimes/WaPo/Guardian to create some awareness and perhaps they can dig further into Chinese influence in using Zoom. I am deeply concerned. The entire world has given up video/audio/screen/application privacy in a snap... for the data might be stored in Tianjin datacenter, needless to say whose keys are in the hands of CCP - I guarantee that but cannot provide proof.
Edit: past comments that were downvoted (and flagged): https://news.ycombinator.com/item?id=22657794
https://news.ycombinator.com/item?id=22684767
It must be so stressful. I think it might drive me crazy. Doing thas job will never be perfect, but let’s all give a big ‘Thank you’ to dang (and any other admins?) who put in non-trivial work, to keep this place running smoothly!
Dang is doing his job and it is tough. He is keeping this place sound and clean. Dang - nothing against you but I see some double standards for e.g. criticizing CCP has far more weight than criticizing western governments. No one gets offended for criticizing the UK Govt or the German Govt or the even the Indian Govt - but when it comes to criticizing the Chinese Govt... we can't do that, it is a flame war. If people get offended, so be it. If someone from China or of Chinese ethnicity is reading this criticism and doesn't like it...well, tough luck. The onus is on the person getting offended, not the offender.
This double standard needs to end (or as I see it through my own lens). Infact, we should be criticizing the CCP even more so than democratic governments.
People get moderated here for posting flamebait about western countries and governments all the time. I'd be careful about that feeling that there's a double standard. It's a natural artifact of the well-known cognitive biases that affect these perceptions. You (i.e. everybody) are far more likely to notice, and to weight more strongly, the cases of moderation that you dislike or disagree with. That gives you a generalized image of what goes on here. But that image is just an inverse reflection of your own views. It's not based on the data as a whole. People with opposite views have the opposite image. To take the current topic, for example, they say that HN has an extremely anti-China bias, any comments that try to defend China or Chinese people instantly get downvoted, the mods are in on the racism, and so on. They have the opposite image to yours, but they have it for the same reason you do: they feel very strongly about the issue, and so when they run across instances in the data stream that touch (i.e. hurt) those feelings, it makes a strong impression. Those strong impressions accrue into an image of bias. But the data stream has more than enough data points to make every such impression. That's simply what you get at scale.
More explanation and links in this recent comment: https://news.ycombinator.com/item?id=22723626
And while I agree with your sentiment regarding the CCP, the comments you link lack the meat of the one you just posted. I'm not surprised they got a kicking.
> I am gonna fire off some anon emails to WSJ/NYTimes/WaPo/Guardian to create some awareness
Well done.
Who is "we"?
In case it's not clear, I'm with you. Either you're in a position to state in what capacity you work or you're not. In the latter, don't hint at it. Just leave that out. It's useless, and more likely to make people doubt the validity of the vague claim.
The organizations that are really that sinister will smash you just as hard for hinting that they're doing bad things under cover of darkness as they will for outright saying it.
If you can hint at it without being smacked down hard, the org you say you fear only has aspirations of evil world domination; it's not there yet.
Of course, maybe OP was scrubbed for hinting at it and we'll never know. Let it be a warning to others who would make vague hints of disclosure regarding their evil overlords.
By all means, ignore it.
I think it was more "can I feel safe as an end user wrt the risk that the CPP intercepting and listening".
When I installed Zoom for Mac for the first time, I noticed it took a while to start up and caused beachballing. So I grabbed a sample of the process via Activity Monitor. To my utter horror, the Zoom binary is shelling out by calling system(3) on the fucking main thread.
I just verified this is the case on the latest version of Zoom for Mac. The binary zoom.us.app/Contents/Frameworks/zmLoader.bundle/Contents/MacOS/zmLoader invokes system(3) on three separate occasions in two functions: -[ZPMBSystemHelper disablePTAutoRestoreWindow] and -[ZPMBSystemHelper disableConfAutoRestoreWindow].
And looking at what the string was, it's just a fucking call to defaults(1). Now I'm not a Mac programming expert but I cannot understand why Zoom needs to change its own preference settings this way. This just screams sloppy software engineering quality. I guess this is what you get when you outsource software engineering.
I would not be surprised at all if someone reports vulnerabilities in Zoom, whether deliberate or accidental.
It may be just anecdotal but their calls work flawlessly, regardless of number of participants, where other apps are just a laggy mess. So yes, their apps are just a means to an end and may be rushed and "low quality", but oh boy do they deliver.
It's not specific to Zoom, they intercept at the global fiber lines, they can watch ANY video they want.
So yes, the CCP can watch your videos and so can the NSA.
I'd be very cautious about sharing information with Zoom. You may be showing it where to fish.
Those last two portions are super critical. No one wants to spend the first 10 minutes of their meeting fighting with their conferencing technology. Also no one wants to sound like robots.
With COVID19 and a ton more people working remote, will there be more competition coming into the space? Sure. But it will take them a lot of work, I'd think, to at least meet Zoom's quality and reliability... and do it either so much better or for so much cheaper to warrant change.
What does zoom do that something like Google Hangouts or Slack doesn't?
Please don't use your company issued hardware/software/network for something not-work related ... and something you wouldn't feel comfortable sharing with most of your colleagues. There is already a plethora of monitoring going on out there.
Based on some quick googling, are you perhaps mistaking Zoom the video conf software with the confusingly similarly named ZOOM International, which does call-center / agent software but is a completely unrelated and a much older company?
An admin, from a dashboard, can see all meetings currently running. If you "click" into one of those meetings for more details, you can also join the meeting as essentially a cohost, you cannot join invisibly.
You CAN see any meeting title, guests, duration, call quality, IP addresses of attendees, Geolocation of that IP, network ti Mic, Speaker and camera in use, and some other stuff.
YOU CAN see all recordings after the fact that are cloud-hosted, Zoom offers 2 recording types based on where you're recording from, laptops like Mac and PC with min spec can record locally, or in the cloud, everything else is in the cloud. I also do not know and do not believe, there is an audit log for this. This is actually the most troubling thing.
You can see more here https://support.zoom.us/hc/en-us/articles/204654719-Getting-...
Also, unlike say Google Hangouts Meet, you cannot add a room to a meeting without consent. Meet allows you to force ANY room into any meeting you want (defaulting with camera and sound on). I've seen people who have these set up in their homes and think of how bad it can be.
EDIT-
Also while no one at my org uses it, I believe you can easily see all zoom chat history.
> Administrators also have the ability to join any call at any time on their organization’s instance of Zoom, without in-the-moment consent or warning for the attendees of the call.
On the other hand, I live in a country where it is considered polite to knock on doors and wait until the door is opened from the inside. And no one is straightly accused of idling behind closed doors.
First there was the issue with them turning on the camera by default. At least you could turn that off. Then there was the spyware they installed on every Mac without even asking for consent. And now this...
Since the spyware thing I refuse to install their crap on my machine, but one of our suppliers still uses it and the web client is very choppy.. But they'll just have to put up with it. I'm never installing it again.
FaceTime does this as well, even when I'm making a phone call via Contacts. I hate it.
If you had added them to Favourites and are calling from there, you added FaceTime (video) as the favourite; delete that shortcut and re-add them to Favourites as FaceTime Audio.
What am I missing? I'm asking humbly. Because it seems like we are complaining about the food at a homeless shelter?
It seems to me that this is the best possible time to make some noise about Zoom's privacy problems. What better time for that could there be than during a period of mass adoption? What better opportunity to shame a company into compliance than during a global pandemic when the responsibilities of companies to the community is being emphasized?
You might have a point if castigating Zoom for spying on users somehow facilitated the spread of corona, but it doesn't.
Everybody assumes every company is a villain these days. Maybe this was an overlooking and they'll happily fix? Anybody ever think of that?
Well yes, an example is their reaction on their Zero Day:
https://medium.com/bugbountywriteup/zoom-zero-day-4-million-...
> Ultimately, Zoom failed at quickly confirming that the reported vulnerability actually existed and they failed at having a fix to the issue delivered to customers in a timely manner. An organization of this profile and with such a large user base should have been more proactive in protecting their users from attack.
'unsafe-eval'
'unsafe-inline'
blob:
https://*.50million.club
https://*.adroll.com
https://*.cloudfront.net
https://*.google.com
https://*.hotjar.com
https://*.zoom.us
https://*.zoomus.cn
https://*.zopim.com
https://ad.lkqd.net
https://ajax.aspnetcdn.com
https://apiurl.org
https://appsforoffice.microsoft.com
https://assets.zendesk.com
https://bat.bing.com
https://cdn.5bong.com
https://cdn.jsdelivr.net
https://cdncache-a.akamaihd.net
https://code.jquery.com
https://connect.facebook.net
https://consent.trustarc.com
https://extnetcool.com
https://fp166.digitaloptout.com
https://googleads.g.doubleclick.net
https://intljs.rmtag.com
https://pi.pardot.com
https://px.ads.linkedin.com
https://ruanshi2.8686c.com
https://rum-static.pingdom.net
https://s.dcbap.com
https://s.yimg.com
https://s.ytimg.com
https://s3.amazonaws.com
https://scout-cdn.salesloft.com
https://sealserver.trustwave.com
https://secure-cdn.mplxtms.com
https://secure.myshopcouponmac.com
https://snap.licdn.com
https://sp.analytics.yahoo.com
https://srvvtrk.com
https://static.zdassets.com
https://static2.sharepointonline.com
https://tag.demandbase.com
https://tpc.googlesyndication.com
https://tracking.g2crowd.com
https://translate.googleapis.com
https://trk.techtarget.com
https://unpkg.com
https://www.comeet.co
https://www.dropbox.com
https://www.google-analytics.com
https://www.googleadservices.com
https://www.googletagmanager.com
https://www.gstatic.com
https://www.youtube.com
https://d.adroll.mgr.consensu.org
https://serve2.cheqzone.com
https://static.ada.support
'self'
The product must be really good. I have never used them more than in couple occasions and found it like any other web conferencing tool in my opinion.
As a result, they're going to have staying power.
Video quality is really only necessary when screen sharing, and zoom does OK there.
I haven't heard this abbreviation before but I assume it means Audio Echoing Cancellation.
Everyone is still on the free plan and reconnecting after 40 minutes (it's basically standard procedure when the 10 minute countdown starts to rejoin). I bet it won't take long before zoom sales get in touch and you think the person going to approve the tailor-made $$$ contract cares about privacy? Or the 700 people already using it except for a small minority who don't have any influence in this kind of decision making?
- Having the Facebook SDK installed in their iOS app, which sends user data to Facebook even if the user has no Facebook account
- Having a setting, that's off by default, that lets other callers see whether you have the Zoom app in focus
- Having a general "accessibility over security" engineering attitude, which led them to eg shipping their desktop apps with a builtin HTTP server (and with it a much bigger security surface area), just to skip one extra step in the join-meeting-via-a-zoom-link-flow. They removed it after a backlash, but the engineering attitude probably didn't change.
Now, I agree that all of these are bad. It's OK for outrage to happen over these things, every single one of them are shit and major companies like Zoom need to get their act together.
But I also think that many apps out there do stuff like this. The majority of popular apps, I'd wager. Why is Zoom being singled out? First Vice, now a Harvard blog, a bunch of unsubstantiated tweet storms.. Is it just, en vogue to diss Zoom somehow?
There is no conspiracy here, calm down. Zoom is popular, therefore people talk about it.
I think this also has to do with the fact that Zoom is being used for work and school and therefore people have less choice over their use of it. It's not a social network that many people have chosen to start using, it's a piece of software that millions of students and other people are being required to use without consideration of privacy.
So we have two anecdotes now I guess.
(Windows 10, if it matters. IIRC I had the same experience on linux)
I haven't tried it this week, but that was the first thing I encountered when my university switched us to Zoom. I could join by browser in Firefox and see screenshare and video, but I would have had to also dial in to hear audio via phone. In chromium, I could get audio and video together. But, it is a more limited interface than the native client in terms of seeing attendee information. This week, I also tried chromium and saw severe audio quality issues. Joining the same meeting with the native client worked much better.
I understand that our university is consolidating and it apparently works for large lectures etc. For my own use, with small technical groups, we were happy with bluejeans before. It worked by Firefox using just webrtc functionality, AFAIK. What I've read is that Zoom is doing their own streaming and codecs, not using browser webrtc functions.
As an aside, I also encountered sudden SSO login problems in Zoom this week on Fedora. They seem to be defaulting to an embedded qt5-webengine browser and this was not working right at all. Editing their config zoomus.conf file to turn off the embedded SSO browser was the only way I could get logged in again.
I think I'd prefer an extension to installing their client.
Slack, on the other hand, can go to hell.
I'm very confused now, because there have been multiple comments in this thread both confirming it doesn't work in Firefox, and confirming that it does.
There are probably a couple of others you can find here and there.
Edit: Well, this thread also.
Try it when you want to control who is speaking and when.
Try it when you want to co-ordinate hundreds of participants and still want to track who has a question so you can hand the virtual mic / airtime to them.
Try it when you want breakout groups and to determine who is in which group, and after a set time for the groups to return to the main space.
What is good enough for 2 people facing each other, and appears to work perfectly well for a group of 5 or 6... doesn't quite scale to a company all-hands, or giving a lecture or seminar.
Tools fit a scale, and Zoom is excessive for the small and simple use-case but excels at the large and complex.
I don't quite understand why Hangouts and Skype aren't more robust than they are. I'm sure this is indeed a hard problem, but the utility of getting it right is obvious, and these are massive companies.
My company has been remote-only for about 1.5 weeks now and we have 4 different conferencing systems that people are using. It's interesting that everyone has their preferences, but for small meetings nobody is using Zoom as far as I've seen.
The people who are concerned about privacy aren’t really the ones writing them big checks anyway.
I'm a fan of the product but this is ridiculous behavior (great Linux support). I have a hard time imagining the product meeting in which "Yes. That's a good idea. Let's do it." was said. I get that FB is big, that Zoom wants the credibility, etc but that's a sign that management is not thinking clearly about their product and should be a red flag to any investor (among the many green flags from current demand)...
Zoom is the only easy to use videoconferencing tool I have found that can do breakout rooms. Mediation is, by law, a confidential process.
From the ConsumerReports article: "Videos aren't off-limits, according to the document, and neither are transcripts that can be generated automatically, the documents you share on your screen, or the names of everyone on a call."
In recommending that my clients use Zoom, am I violating my ethical and legal requirements? Is Zoom breaking the law?
Also, at my work we use zoom for everything. It is a powerful software that we love.
I have used Skype, webex, hangout meet, gotomeeting, various other entirely web based ones and none come close to the reliability that Zoom provides. No wonder it's getting adopted like crazy.
Kudos to them for handling this traffic with absolutely no visible hiccups.
Anyone know what that permission is even about?
I think it's amazing how zoom became so popular recently. It's even been approved to be used for Passover Seder dinner by some Rabbis :)
It also very popular in academia and reminds me of Dropbox. When I was a student everyone around me used Dropbox. They developed a great product which competes with Google and other giants. But those were all unpaid users and eventually Dropbox moved their focus to Enterprise. Zoom will soon be in a similar situation.
https://d24cgw3uvb9a9h.cloudfront.net/static/40580/doc/Zoom-...
Is Zoom really the best? No other comparable platform out there?
Anyone know how difficult it would be to build something like it on top of aws or a similar cloud?
In terms of actual reliable video/audio experience. When evaluating platforms, other videoconferencing solutions simply suffered quality issues more -- taking longer to start, glitches, latency, pausing, echo, and so on.
Also, the hard part isn't building 1-1 video chat. It's having it work with 20 or 200 separate participants.
I have no idea why they're better except that building reliable audio-video at scale turns out to be a really hard problem, and they seemed to focus their engineering on that specifically.
Kind of like file sync was really unreliable until Dropbox decided to focus on building a sync tool that actually "just worked". Same philosophy. Zoom is the Dropbox of videoconferencing.
Then consider that contention is terrible for real time and you would want dedicated instances.
I don't know the zoom architecture, but I doubt they could scale so fast without lots of cloud. I think they have an enormous bill, which they are using capital to pay for because they are becoming a household name.
Companies have been trying to build the perfect video chat system for about 30 years. Companies with tens of billions of dollars in cash and more in stock. Almost all of them suck in various ways.
You can stream one audio+video to one person, and you can stream it to multiple people. But then do multiple duplex audio+video streams to multiple people, on multiple platforms, with low CPU, memory, and bandwidth requirements, with user controls, recording, chat, screen sharing, drawing, and 50 other features. Get 49 of them right, and the 50th feature will suck, and your users will hate it and be ready to move to a different product. I think it's one of the most complex user applications that exists.
And that university chooses to use Zoom over another solution for many reason - after-sales support, SLAs for performance and availability, pre-written API integrations for their CMS and student ID system, guarantees from their sales team about regulatory compliance, and the like.
Just to clarify - the zoom room is not mine. We are using it across a group of like 10, for a group meetings - sometimes all of us, sometimes subgroups, sometimes one on one.
I can not imagine a world where a company would do that, but given the recent events, I am not ruling out this level of creepines.
Zoom?
Objection - best advertised (or should I say "best" advertised) doesn't equal best. I'd be truly surprised if somebody actually presented convincing arguments that Zoom service is better than anybody else.
Webex addresses are stupid by comparison.
I don’t like this Facebook crap but otherwise Zoom is pretty slick.
https://www.vice.com/en_au/article/z3b745/zoom-removes-code-...
Of those, I tried whereby.com yesterday and was blown away. It just works with zero downloads in any browser, including mobile, and is very high quality. From my brief usage, I highly recommend it for small teams.
Zoom is as good as video can be in 2020. Google may be on parity, but tools like WebX are laughably inferior.
It's like WTF, another contender for this throne? Sigh.
However, I would also like to know if there's more to it. Do they do any server side transcoding? Do they get an advantage by having multiple backend servers connected through good links, having clients connected to the nearest one and routing efficiently through their network? It appears that they use(d) H264 as their codec, are there some technical tricks they use to cope with variable bandwidth (do they use scalable video coding or simulcast)?
That’s how your comment reads. The fact that it’s worth so much is almost completely irrelevant, and if anything, should mean they have more responsibility to do the right thing.
If it's a real problem, go sue them. Do you need a Havard op ed to tell you?
One that has been a total game changer for my company is when I'm hosting a conference call, I can simply "Invite by Phone" my participants. They get a phone call, are prompted to "Press 1 to enter the conference", and boom they're in. It's drastically reduced people fumbling around with phone numbers + participant codes, ending up in the wrong meeting, or getting stuck in some unnecessary software install loop. If someone is more than two minutes late, they're getting a phone call that brings them instantly into the meeting.
Also a really nice feature, again for phone conferences, is when people dial-in I see their phone number handle in the UI. But during the call as they introduce themselves or I look up their number, I can then rename their user to something recognizable. Now if I'm on a call with 5 people at another firm, I appear really impressive because I know who each person is by their name. When someone is speaking on the conference call, their icon lights up. If someone has a ton of background noise I can easily mute them.
Zoom Phone (addl paid feature) is awesome too. Virtual phone numbers, IVR, call routing, busy hours, I can instantly turn a 1:1 conversation into a zoom meeting that other people can join, etc. Zoom Phone works on my iphone like a regular dialer, and I can place/receive fully digital calls on it (pretty similar to how Google Voice works), so it doesn't matter if I have actual cell service.
I've never used Microsoft Teams, and does look really snazzy, but Zoom is an absolute joy to use compared to every single other conferencing software I have ever used. The video chat and screensharing is fast and responsive and just works exactly like you would expect it to.
WebEx always took a while to on-board.
Does it?
Asking because I just left a zoom meeting with horrible sound quality and extremely bad video quality. Why would anyone prefer that to Teams is beyond me.
Edit: interesting this is _heavily_ downvoted. Can't a person have a bad experience and tell HN about it?
I can say Zoom is way the hell better than: Slack/Screenhero, TeamViewer, join.me, GoToMeeting, WebEx, Skype, Google Hangouts, BlueJeans, ugh the list goes on over the past years.
I had a horrible meeting today (not the first time, but today was particularly bad).
In fact, I recorded part of it with my phone and tomorrow I Will have a chat with our IT people to ask people to avoid using zoom.
But another, more important one is: the last time we tried using Teams/S4B meetings, if you are contacting a client where they are in a different Office 365 tenant, and the security settings are turned up on their tenant to not allow logging in as a "guest" to other tenants, they can't join your meeting. (or at least, not without launching an incognito window and reopening the meeting link) Azure AD tries to login as their user account, fails because they aren't allowed, and leaves them on an error message screen without any way for the meeting host to troubleshoot. Zoom, since it's out of band of anything that IT usually touches (unless you turn on the "only allow people in my organization to join this meeting" function), won't have this issue since the outsider will automatically be offered the choice of logging into a Zoom account or just giving a name for this conversation (as far as I've seen).
It's one of those scenarios where Microsoft being so entrenched in the environment actually lessens productivity. You can argue that people shouldn't be blocked from joining outside meetings, or that shadow IT is evil and should never be encouraged, but when security steps in the way of productivity, shadow IT usually naturally results, as so many SaaS vendors (Zoom, Basecamp, Dropbox) rely upon. Zoom acts like malware (to a degree) by installing to user-only directories and working around corporate security to make it easier for the end user to use the product. At a big company, approval for a video conferencing system could take months of PoCs, vendor meetings, implementation, and so on. But if you can just say "Join my Zoom meeting! It takes a minute! It integrates with Outlook so we don't have to even go to another website! And it's cheap!", then all of the corporate BS is cut through, and by time IT finds out, half the company is using it and they'll start paying for it so the enterprise stuff works (i.e. SSO).
(Basecamp is another good example of this. It gets tons of adoption by running in a browser window and only costing $99 per month for unlimited users, so it fits on a manager's expense account and user onboarding is super simple from there. and it's really easy to use.)
What's really funny is if a VP says, we should start evaluating enterprise conferencing software, get's down the road with the webex and friends sales teams, and then everyone tells them to go home because it's too late when they finally have the roll-out meeting or the feedback meeting - everyone is using zoom already.
One reason zoom is POPULAR with the IT folks - less tech support / help desk stuff. Test my audio is the biggest tip for folks stuck.
Not necessarily, no. It's downvoted because it's one low-evidence anecdote amidst comments from people who've been using it daily (two years, here). That doesn't mean it didn't happen, but without supporting evidence it's difficult to find relevance in a single poor call.
Some basic evidentiary questions for you to consider, that would help distinguish between "someone's Internet was broken" (more likely) and "Zoom is defective" (less likely), for example:
1) Was only one participant experiencing issues, or were all participants blurry? Did Zoom warn you that of connection instability? Did Zoom show yellow or red connection status bars for the affected participant(s)?
2) Does your (or their) Internet connection show instability such as high latency (Bufferbloat) when performing a speed test capable of measuring and reporting latency-under-load fluctuations? https://dslreports.com/speedtest
3) Did the sound quality issue involving one or more participants who were not using in-ear or over-ear headphones?
4) Was the sound quality issue reproducible in a followup call for testing? Was it reproducible using "call in by phone" audio rather than "internet" audio for testing?
EDIT:
5) If you stop sharing your video, does the problem improve? If you activate screen sharing, does the problem worsen?
To answer your other questions: this was not the first time and there are others here expressing similar issues. Teams works reasonably well from same computer & network.
1 of the 2 big cell phone networks we have: Rogers, is regularly failing to connect calls during peak hours for the past week. Being able to do digital calls has changed a lot, and probably took a load off their network.
(I say 2 big networks because Bell and Telus share tower infrastructure, Dunno where it separates out again, possibly just billing.)
You’d be shocked (maybe) how much White-labeling and reselling there is in the communications/“unified” communications and presence space.
Especially now in the age of programmable voice.
As an aside, I hate that phrase. I get it, but i find it cringe-inducing.
This isn't a critique of reselling or whitelabelling a communications platform that provides good value; it's just that there are a LOT of bottom-feeders latched on and hiding in the tangled web of resold trunks and bulk-purchased DIDs wreaking a lot of financial havoc.
I speak of course, to robocallers/robotexters and their kin, which are not new problems but have only been amplified when access to the public switching network became as easy as 'buy a voice over IP DID for twenty-five cents'. I am however curious to see the impact of SHAKEN/STIR.
This all to speak nothing of toll fraud committed via compromised SIP trunks (most often due to poorly configured Asterisk instances setup so an MSP in BFE can say "we sell phones"). Preserving the names of the involved parties but I have seen bills for some consulting clients that reached beyond six figures from one month of toll fraud. The culprit? The office had bought a "PBX in a box" from a local vendor, who only configured it enough to get a dial tone and a phone number from randomly registered CLEC, connected the thing to the public internet, and walked off with a hefty paycheck.
The FCC doesn't really get off the hook here either, while there are requirements and guidelines for inter-connectivity to the public switching network, enforcement is-or in my own anecdotal experience since 2001, non-existent sans making sure you've paid your USF dues. I'm open to correction on this point, if anyone has experience on the matter I'm curious to know what the interaction was like; the rest is mindless opinion.
Taking this last point a bit further and bringing it all home: You could very easily start a "phone company" in rural Georgia with pretty low comparative overhead and sell phones service to an entire community and trivially disappear overnight before the Feds even glanced in your direction with more money than you put into it. Left improperly secured, the robocallers just found a new forward operating base.
If anything I'm aiming to point at the (perhaps unintended) results of making telecom so easy, in a way we created these problems, this is the bed we've made for ourselves in the industry.
https://www.ringcentral.com/whyringcentral/company/pressrele...
Teams sorta works, though it often messes up with devices. Headsets and speakers (I've got a Jabra speak 710). Often times it handles contention badly.
Skype ... yeah. The less said the better.
Webex. Must be marketing for Zoom and others, given how unreservedly horrible the UX is.
I've also used uberconference some years ago. Almost as good as zoom.
I am looking at containerized ways to run zoom to restrict its access to my system, but it is the best IMO, by far.
[edit] I should note that I've also used Viber a bit. Less now though. Mostly for calling home from overseas. Not great for conferencing though.
I use linuxmint, so largely, I don't run into these issues.
Contention on uberconference is MUCH worse when two people are speaking. You get that weird halting sorry I spoke on top of you effect.
In the present era QUIC can support doing this, although whether that'll be something every popular implementation actually does remains to be seen, but again a high quality implementation will be able to just rebind - "Hi, this is still me, I just have a different network address now" and carry on seamlessly.
Why on earth are people needing to make POTS phone calls to join a meeting? Not only is the audio of vastly inferior quality, the information isn't being kept secure AND they can't see anything being presented.
Instead, why not shoot them a link so they can just click it and be in the meeting? That's how it SHOULD work, but that's not how it DOES work with Zoom (unless you engage in tomfoolery to make like you're trying but failing to install the software, and only then do you get a link to join via browser — but then then you get a deliberately-crippled experience because fuck you).
Jitsi Meet has this feature
If some of you 10x programmers would go on a Mission from God and get it going that would be super cool.
It is quite possibly the simplest videoconferencing I have ever experienced (Google Hangouts, BlueJeans, Skype for Business and Microsoft Teams being my experience.) I like the Teams experience but the simplicity of just copying an URL from that Jitsi Meet page and having it work within a minute of 5 elderly non-technophile users receiving it in their emails is incredible.
Just looked it up. Seems to be Chrome only. As a Safari and Firefox user, that ends my decision-making tree with two clicks.
You don't need chrome though, chromium should be enough.
https://www.cnbc.com/2019/03/26/zoom-key-profit-driver-ahead...
Look at the top of page 21 of their sec submission. https://www.sec.gov/Archives/edgar/data/1585521/000119312519...