Hacker News Reader

Comment by AshamedCaptain | Hacker News Reader

Seriously, all people who are surprised about this type of news should really understand that most "successful" (as in, popular) tech/.com/SV "startups" these days are like this.

If you "waste" time on the real important stuff such as a good design, user security, or the like, you will lose over to a competitor who didn't and therefore was able to spend more time on marketing.

If you waste your time on user privacy you will be totally crushed by that competitor whose definition of "privacy" was "how much can I pester this user until he gives me access to his address book so I can spam his friends?".

I don't think this is good. I think this is very sad. But it is what it is.

I still remember the Whatsapp founders coming into the jabber mailing lists with "please let me configure my server"-type questions, for god's sake.

View on HN

Agree, but I want to add something: the usability of Zoom is good, even for casual computer users. Strategically, they focussed on what they considered to be the things that would give them sales. Not saying it is good, but it certainly worked for them (at least until now).

I agree. My SO ist currently studying from home due to the pandemic. A lot of professors and tutors use what they find first. There is no standard.

She already had to use MS Teams, Slack, Jitsu and Zoom. Her take was that Zoom was by far the most usable tool. And most of her 20 years younger co-students agree.

Sadly most people don't even know about the problematic status of Zoom. And if one tells them, most do not understand what's so problematic about that.

Partly because it isn't really problematic for students and teachers that are trying to use VTC.

When the alternatives don't work, it doesn't really matter how secure the alternatives are.

The students are all forced to agree to these abusive third party TOS simply to receive the education to which they are entitled/for which they have already paid.

That’s a bait and switch on the part of the university. “You’ve already paid, but now you have to give up your civil rights against this third party you’ve never heard of to get the service.”

There should be liability for the schools for doing this. A class action, perhaps?

There's a pandemic, schools and professors try what they can to keep the courses running and not ruin their students' year, and your reaction is "sue them"?

They’re pulling a bait and switch.

There are video technologies they can license so that they can keep things running without forcing students into having to enter into abusive third party agreements. They can hire people to set up simple first-party HLS streaming systems—it can be done in a day. There are tons of non-abusive alternatives. Zoom makes malware. Can you imagine being given the option by a university to whom you have already paid tens of thousands of dollars: “install this malware or you don’t get to come to class”?

You could say the same about Amazon and their backlash against workers. “There’s a pandemic, and this company is doing what it can to keep the supplies moving, and your reaction is “sue them”?”

Yes, that is the appropriate reaction if they break the law.

A pandemic does not justify abusive, coercive behavior. If anything, it makes it more abusive.

Pandemic really shouldn't be an excuse to just sell out students to any party that used more marketing money.

There's a reason why (at least in this part of the world) the educational products receive additional scrutiny and need to comply to additional privacy and security directives.

I agree this isn't uncommon, but that does nothing to make it acceptable.

Bad security design is unacceptable and this is sort of indicative of a large dissonance when it comes to SV startups. "Disruption" isn't ignoring requirements - if you are able to under price your competitors because you fail to adhere to good practices (or, more importantly, regulations[1]) you're not building a lean and useful product - you've just built a half-assed competitor that can undercut prices because it is incomplete... You're selling something as a competing solution when it only does half the stuff.

There is a lot of good to be said about identifying the 90/10 value components of a problem space and discarding expensive features that would just add complexity for little value - but if those features are requirements you're just failing to actually meet the points consumers (or markets ala regulations) expect and making your profit off of deceit.

1. Looking at you Uber.

But, the parent's point is that it is acceptable. Zoom has become a $300mm company all the while flatly lying (or being very generous in statements). What is the consequence for them? They made rapid market growth because they didn't waste constrained resources on security/privacy concerns.

No consequences means their behavior is acceptable. Which means this will repeat until there is a reason that makes this behaviour not acceptable.

This is a bad point. The difference between using AES-128 and AES-256 from a code standpoint is trivial. The only explanation for this is either gross incompetence or malevolence. Personally I don't use Zoom, nor would I recommend its use for even personal conversation.

the difference is a copy and paste from an older StackOverflow post.

Using code without understanding its implications would fall in the gross incompetence category.

And my point is that this happens all the time. Natural selection seems to favor the type of company that would just copy&paste from SO (then spend their resources on some fancy viral marketing) instead of the one that would stop to think about it.

People shouldn't be surprised, but they should be upset.

Awfully big talk on a Friday!

Have you studied the performance implications of different key sizes on real-time video applications? A little bit of reading suggests AES-256 carries a significant performance penalty vs. AES-128. I would be keen to hear from someone who has tried it in real-world situations and can demonstrate AES-256 working well on e.g. low-end android devices/cheap laptops without issue.

I use Zoom regularly. Their video works well. I would like to have AES-256 but also I suspect this is not a casual choice, and I'm not sure it's as clear-cut as you're assuming.

But when I see "roll their own encryption," it tells me that they went out of their way to create something subpar. There are some things that one should never* roll one's own of, and encryption has to be the top of the list.

* OK, if you're an encryption expert, you obviously would roll your own to advance the state of the art, but Zoom are quite obviously not encryption experts.

"Roll your own" is such a oversimplification.

Usually it is: I can spend all this time making things right, or bob here knows how to do this other simple way that is good enough in a week.

It's so much more important to make things right than to have something "good enough" (which is never actually good enough) that reducing it to that simplistic binary is not all that drastic.

I think you might be missing the bigger picture. You have a company that the "Ministry of State Security of the People's Republic of China" can easily hack to spy on American children and businesses. What could go wrong?

Not just American. Someone posted a screenshot on HN yesterday or the day before of the prime minister of the United Kingdom having a video chat with about 16 other top government officials over Zoom.

Anyone want to wager how many of their computers are now p0wned.cn?

More generally, there is a culture of celebrating rule-breaking or even law breaking within the startup community. As long as you get away with it, and make money off it, then it's totally cool...

That’s also partially a reaction to so many rules and laws being utterly counterproductive and/or corrupt. Respect for rules and regulations depends on those rules and regulations having respectable motivations and effects in the first place.

It does lead to a general sense of degrading lawlessness throughout society. When powerful people start to have contempt for laws it can get really abusive.

Sure. But at this point everyone picks and chooses which laws they care about. I've observed a pretty heavy overlap between people who care a great deal about taxi regulations (most of which exist merely to artificially prop up rent-seeking owners of taxi medallions) and people who consider American immigration law so fundamentally unjust that it should simply not be enforced anymore. Faithfully Obeying All The Rules And Regulations isn't an especially popular ideology, and if you consistently advocate it, you'll end up very unpopular with everyone.

Immigration is a tough issue. The debate is now mostly focused on what to do with undocumented immigrants who are already here, perhaps with families, etc. That's one issue which has been debated to death.

But there are also perhaps hundreds of millions of potential immigrants worldwide who would love to come to the US permanently and have the means to do so, if it were legal. But they cannot get a green card or h1b because those are nearly impossible to get from people in some counties. So they never come.

It does seem hard to decide a fair system here but any decision is just that... A system of laws... They have no meaning unless followed. What's the point of rule of law anyways? It's the answer to arbitrary rule: by monarchs and dictators.

> The debate is now mostly focused on what to do with undocumented immigrants who are already here, perhaps with families, etc. That's one issue which has been debated to death.

Which is exactly my point. According to the law, these people are illegal aliens and the government has every power to stop them from crossing the border, detain them if they're already here, and deport them to their countries of origin no matter how long they've been here. And they have no legal right to reside in the country. And a lot of conservatives argue that "sanctuary city" proclamations represent a fundamental disrespect for the rule of law.

A lot of people balk at this notion and start arguing that US immigration law is fundamentally unjust and that it's reasonable to make exceptions. And that's a perfectly reasonable perspective, but it's hard to keep that consistent with the idea that taxicab medallions, for example, are some unquestionable pillar of society.

Forming a mass consensus on what reasonable exemptions to the laws should be is exactly how the lawmaking process in a democracy should work... What I hear you saying is that we don't live in a functional democracy. I don't think, however, that individuals or cities selectively following laws is going to get us any closer to a functioning democracy.

It is easier for Zoom to apologize and fix than for zoom to have no customers but a solid stack.

I more suspect it is a problem stemming from hiring people who are all new to professional programming. Avoiding these issues means hiring some older, experienced professionals.

Those cost more.

Much cheaper than trying to put out the fires caused by not using them.

Experience costs more because it pays off.

Yes, but people are short sighted. They also probably think “I’d rather grow quickly and be able to afford this down the line than do it right and risk missing out.”

> Yes, but people are short sighted.

Which comes from being inexperienced as well. And an experienced hand can save you money immediately. Such as selecting a more appropriate programming language to implement the project in. Suggesting an appropriate library to use rather than rolling one's own. Avoiding multithreaded coding disasters. Having a backup system that works. Having a revision control system that works. Knowing that unit tests have an immediate payoff. Avoiding stupid metrics like paying people based on lines of code written. Avoiding rolling your own encryption. Don't transmit passwords in plaintext. Don't do illegal things. Don't leave yourself wide open to lawsuits. Use a real CPA to do your taxes. Keep proper business records so the IRS doesn't hang you. And on and on.

My CPA makes lots of money when some young entrepreneur comes in all terrified that the IRS is auditing him and he kept no records and didn't even file returns.

An experienced hand will tell you to never ignore and never mess with the tax man.

Check out what happened to Will Smith when he paid no attention to the IRS. All his proceeds from "Fresh Prince of Bel Air" went to the IRS as taxes, interest, and penalties.

Is this maybe a side effect of leadership in these startups being more junior themselves and not realizing the value they're missing out on by not pulling in some of that experience?

There is little to no penalty if your software is crap from a security or privacy point of view and you are popular enough.

The example I used is Whatsapp. On the early days, but definitely after their popularity was already high in Europe, you could still impersonate any user on the platform trivially. Their only real security was obfuscation of the client source code, obfuscation of the protocol. Doesn't help much when you still have a Java (J2ME) client that is trivial to decompile. They still became hugely popular.

People quickly forget about this type of issues, or they don't assign blame where it belongs. They will just shrug over it and start believing that it is normal for computers to get hacked from time to time. After all, it appears all the time on TV.

There's a reason airlines don't put a freshly minted, cheap pilot in command of a 747.

I know market cap isn't everything, but just thought I would look it up.

Zoom (ZM) has a market cap of $40.77B (with a forward PE of 327.31...). Delta (DAL) has a market cap of $18.19B, with a forward PE of 3.91.

Like I said, market cap isn't everything, but I find that astonishing.

Well, the airlines are being destroyed at the moment.

Or hiring people solely based on Leetcoding interviews. Seriously, every interview I've had in the last decade focused on algorithms/data structures but it was very rare to get any questions on security. This applies to startups and larger enterprise companies alike.

Security implies experience. They don't care anything about that. Just hire cogs to grind away and fire when they burn out.

Reply on news.ycombinator.com