[HN Gopher] The Zoom installer let a researcher hack his way to ...
___________________________________________________________________
The Zoom installer let a researcher hack his way to root access on
macOS
Author : neodypsis
Score : 557 points
Date : 2022-08-13 06:05 UTC (16 hours ago)
(HTM) web link (www.theverge.com)
(TXT) w3m dump (www.theverge.com)
| dillutedfixer wrote:
| I just had to (reluctantly) install Zoom on my freshly formatted
| MBP for some classes I'm in. The web client wasn't that reliable
| for me. Unless I'm totally missing something here, it let me
| install as non-root. The installer asked me if I wanted to
| install for all users or just for me. I chose just for me and it
| never asked for an admin password and installed to the
| Applications folder under my user and not the main Applications
| folder. There doesn't seem to be any daemons or background
| processes running when the application isn't open.
|
| edit: meant this in response to some comments below about Zoom
| requiring admin access to install on macOS
| mikeryan wrote:
| If yours is the primary account on the mac then, essentially,
| your account is "root".
| SoftTalker wrote:
| No it isn't, it's like any account that has sudo permission
| to become root.
|
| It isn't root all the time, and is only root when provided
| with the proper password.
| mikeryan wrote:
| That's why I said "essentially" the whole point of the
| attack is that the installer gets "root privileges" when
| the user enters their password to install. It's kind of
| moot if they're actually root when it's got super user
| privileges.
| dillutedfixer wrote:
| I should have clarified. My account is a Standard non
| admin account. It never asked me for my password or an
| Admin password.
| caymanjim wrote:
| Is there any practical impact to this? Zoom is broken, shouldn't
| need root at all, and there's no excuse for this kind of
| sloppiness, but...does it matter? Is there any Mac out there
| where this is a problem? Is there a single Mac out there with
| multiple users and Zoom installed? I'm being slightly hyperbolic,
| but this is a giant nothingburger.
| calvinmorrison wrote:
| I am of the camp that very little software should be installed
| globally. Instead I make use of a precocious and large ~/bin
| and other things in my less privileged user directories
| epistasis wrote:
| I've gone as far as to keep an ~/opt that has bin/, man/,
| lib/, src/, etc. underneath it, and when I can use --prefix
| on the configure script.
|
| Udocker and singularity (the containerization toolset) also
| help a ton too. Docker's root requirements make it unsuitable
| for lots and lots of situations where it would otherwise be
| useful.
| system2 wrote:
| Zoom has been the crappiest most widely used software of this
| decade.
| ajross wrote:
| So... why exactly does Zoom even have root on the mac? Google and
| Microsoft make all this stuff work in a browser...
| [deleted]
| codedokode wrote:
| Researchers try to find complicated and unrealistic scenarios to
| exploit vulnerabilities, but do not notice an elephant in the
| room. Auto-update is an equivalent of a backdoor. It allows the
| company to upload and run any code at any user's computer
| unnoticed. I won't be surprised if soon governments will demand
| that every application having more than N users must support
| auto-update.
| alliao wrote:
| does chrome update work the same way? i've felt uneasy enough
| that have jumped to firefox some time ago..
| origin_path wrote:
| It works in exactly the same way.
| grishka wrote:
| I like to call auto-update functionality what it really is: a
| deliberate RCE vulnerability.
| dtx1 wrote:
| That's an unfair argument to make though. I think in
| practical terms an auto update on a browser like chrome
| prevents an enormous amount of security breeches from truly
| malicious, criminal actors using public CVEs for their
| average users. And as much as i dislike google and their
| privacy invasions, chrome is likely one of the most secure
| browsers out there and a lot of people rightfully rely on
| chrome's security for very important things like their online
| banking.
|
| I'd rather have my mom use auto-updating chrome than having
| to remind and reteach her how to update chrome manually once
| a week.
| klabb3 wrote:
| The worst part is abusers of macOS install/update options are
| going to be used by Apple to further lock down app and update
| distribution outside of the app store. There are already changes
| coming in Ventura regarding "self-modifying code" which affects
| custom updaters. These types of security changes are eventually
| necessary, the problem is that Apple takes every opportunity they
| can to break apps outside of the app store pipeline, even though
| the security mechanism itself doesn't depend on any app store.
| neodypsis wrote:
| Zoom is already distributed for iOS in the App Store. Why not
| give users the option of installing the macOS app thru the App
| Store as well? I trust Apple more than Zoom and would prefer
| installing the latter's app from the App Store knowing it will
| comply better with best practices.
| pxc wrote:
| > There are already changes coming in Ventura regarding "self-
| modifying code" which affects custom updaters.
|
| Per-app self-updaters are such a disgrace, it really makes me
| wish I could cheer this on. It's a shame that their
| elimination, for Mac users, might mean that the app store
| becomes the only or primary mechanism for automatic app updates
| on macOS.
| galad87 wrote:
| The change doesn't affect self-updaters, only a app trying to
| update a different app from a different developer (which can
| still be done, but with some additional checks I don't
| remember).
| userbinator wrote:
| Such changes are not necessary. They only use security as an
| excuse to take away freedom and control, because it suits their
| motives.
| [deleted]
| fortran77 wrote:
| FWIW: This wasn't an issue on Windows Zoom. The Apollo-era Unix
| permissions systems that MacOS uses was the issue. More modern
| OS, like Windows 10 and 11, don't have this vulnerability.
| teakettle42 wrote:
| macOS has supported NFSv4 ACLs since 10.4 (released in 2005),
| and Zoom could have made use of them.
| ardel95 wrote:
| It's way past time we accepted that all current operating systems
| are single user environments. Any access to the system means full
| access to the system.
| throwawaypcking wrote:
| Linux isn't this way. I can understand Windows and perhaps Mac
| users have this predicament.
| ardel95 wrote:
| May I introduce you to a long list of Linux breakout and
| privilege escalation CVEs.
| lokedhs wrote:
| This is precisely the realisation that is the basis of Qubes
| OS. The entire system is basically an admission that you cannot
| hope to preserve security on a system where you have users
| running stuff.
|
| Just allow them to do anything, but isolate the environments
| such that it doesn't matter if one is compromised, because
| there is nothing to compromise other than the application
| itself.
|
| Strongly recommended if you're willing to live without GPU
| support.
| thehappypm wrote:
| Yeah. The browser is the only safe haven. And even the browser
| has its issues..
| [deleted]
| [deleted]
| zadwang wrote:
| The discussion is mostly about features of teleconference
| software which is completely off topic. The point of the article
| is security. I am not sure if Zoom INTENTIONALLY left the bug for
| future exploits. I have suspicion and no proof. But in any case,
| not fixing a bug after 8 months is simply unacceptable.
| vladvasiliu wrote:
| > I am not sure if Zoom INTENTIONALLY left the bug for future
| exploits.
|
| What would they stand to gain from this? They already have root
| on the machine, so they could just send an "update" to that
| code to do whatever they need.
| pxc wrote:
| This kind of stuff is why macOS 'needs' System Integrity
| Protection. Unlike on Linux or the free Unices, users of macOS
| are expected to frequently and repeatedly give a large assortment
| of proprietary crap root access in the form of installer scripts
| in their .pkg files.
|
| The management of proprietary software is a frickin' minefield.
| The idea that publishers should be trusted to manage their own
| installations like this is madness.
| danieldk wrote:
| Shrug. At least Mac App Store apps are sandboxed. On Linux, you
| are only one vulnerability away from full user account
| compromise.
|
| (Zoom should just be an App Store app, not a crappy installer.)
| pxc wrote:
| Linux definitely lags behind macOS and mobile operating
| systems with the maturity and integration of sandboxing
| options for GUI apps. Hopefully Flatpak (or XDG Portals with
| just a policy system or something) can fill that gap for most
| apps in the future.
|
| And Linux users can typically expose themselves to the same
| shit as Mac users with Zoom here: when they grab proprietary
| DEBs for Discord or Google Chrome or whatever, those can run
| scripts that mess with the whole filesystem or call out to
| the internet at install time. It's only by _convention_ that
| those behaviors are forbidden in the normal repos on most
| distros.
|
| I don't love that the only repository-like option that's part
| of the normal system is the App Store, or that it doesn't
| come with an official CLI. I can see how some small
| proprietary software authors trying to make a living might
| resent being funneled toward a platform where Apple takes
| their cut, and I empathize. But for end users, I still think
| centralizing app updates into one system and taking the
| implementation details out of the hands of app
| developers/publishers is the only thing that makes sense,
| even if that always means going with the App Store.
| nicce wrote:
| On the contrary, advanced user can very easily sandbox all
| the apps in Linux. But anything custom is hard on MacOS.
| danieldk wrote:
| Sure, you can use something like bubblewrap, but it doesn't
| make applications easy to sandbox. E.g. how do you sandbox
| an application and still make it possible to use Open/Save
| dialogs.
|
| You need to use something like portals like Flatlak does.
| But the Flatpak sandboxing model is clearly inspired by
| macOS and hated by a significant portion of the Linux
| community.
| spideymans wrote:
| Software publishers should not be allowed to get away with this
| with impunity.
| muh_gradle wrote:
| Doesn't surprise me the slightest
|
| Zoom has some of the most archaic security practices I have seen
| in 2022. It really practices security like it's 10-15 years
| behind a modern company. Almost all top-down initiatives to
| improve security have meant useless red tape practices such as
| hiding information from its own internal developers.
|
| source: I work at Zoom.
| thfuran wrote:
| >Almost all top-down initiatives to improve security have meant
| useless red tape practices such as hiding information from its
| own internal developers.
|
| That doesn't sound like outdated security practices, it sounds
| like unconscionable bullshit.
| buildbot wrote:
| It sounds like a way to insert code a majority of the
| developers would tell others about, like actual spyware.
| amelius wrote:
| I think that on MacOS there must be two layers of root. One for
| owners, and a lower one for Apple. What is the correct
| terminology for these two layers? When people say "I have rooted
| the device" they typically mean the lower layer, whereas when
| somebody becomes root by typing "sudo su", they refer to the
| higher layer. Which is confusing.
| jyrkesh wrote:
| Sounds like Administrator vs. LOCALSYSTEM on Windows. Oh, and
| TRUSTEDINSTALLER.
|
| I know Windows has its issues, security and otherwise, but they
| actually did have some insightful prescience on this class of
| problems.
| pram wrote:
| It's called SIP, or rootless, but it can be turned off by the
| user unlike iOS. So you don't need to 'root' a Mac.
|
| An admin user in MacOS is always in sudoers though.
| api wrote:
| Why does Zoom need a f'ing installer? There's nothing it does
| that couldn't be in a sandboxed App Store app, and they certainly
| have the resources to easily publish one. If they need a bit more
| a regular drag and drop app would suffice.
| vinay_ys wrote:
| For years, I have refused to install zoom, webex etc clients for
| exactly this reason. Their installer wants admin user access for
| no apparent reason. They could have given a simple drag and drop
| installation app. Instead they want to run an installer with root
| user permissions to do whatever. Also, I hate apps that installs
| a helper background program, and doesn't let me disable it via
| preferences. I refuse to use those too.
|
| Besides, for what zoom does, why do they need an app? Browser has
| all the capabilities they need.
| jacquesm wrote:
| The same goes for teams.
|
| Just a little snippet from the Teams installer page: "Windows
| Firewall configuration will be altered even when the prompt is
| dismissed by selecting "Cancel". Two inbound rules for
| teams.exe will be created with Allow action for both TCP and
| UDP protocols."
| jameshart wrote:
| How do you do screen sharing, or sharing a specific window
| belonging to another program, from a browser app?
| Rafert wrote:
| With the Screen Capture API:
| https://developer.mozilla.org/en-
| US/docs/Web/API/Screen_Capt...
| pleb_nz wrote:
| Agree totally, only problem is, imo, the browser experience,
| even for well built web apps, is 'usually' subpar or more
| problematic or poor performing than a desktop app.
| acdha wrote:
| Than a well-written desktop app, maybe. Electron apps set the
| bar lower - for example, Microsoft sat on shipping ARM builds
| for Teams until this month so for a couple of years a browser
| was faster and used far less RAM.
| FBISurveillance wrote:
| Google Meet is a great example of an app that uses AV and
| works well, running in a browser. Even with a large number of
| participants - and no client required.
|
| On the other hand, Zoom web client is an afterthought, to put
| it nicely.
| nikanj wrote:
| Are you talking about Google Meet or Google Meet (nee Duo)?
| It's hard to keep track, when they both have the same name
| https://www.pcworld.com/article/707997/google-pledges-to-
| mak...
| piperswe wrote:
| I think they're referring to this one:
| https://meet.google.com/
| divbzero wrote:
| I like Google Meet and Skype in large part because they have
| decent web clients with instant meetings without sign in [1]
| [2].
|
| [1]: https://meet.google.com/
|
| [2]: https://www.skype.com/en/free-conference-call/
| latchkey wrote:
| "When Zoom issued an update, the updater function would install
| the new package after checking that it had been cryptographically
| signed by Zoom. But a bug in how the checking method was
| implemented meant that giving the updater any file with the same
| name as Zoom's signing certificate would be enough to pass the
| test -- so an attacker could substitute any kind of malware
| program and have it be run by the updater with elevated
| privilege."
|
| This is beyond absurd.
| rtev wrote:
| You might think so, but these kinds of logical errors are in
| everything. Someone didn't sit down and write "file name ==
| certificate", but unexpected behavior during tainted data
| processing resulted in that.
|
| Even the best programmers constantly make these mistakes in
| large code bases.
| bscphil wrote:
| The best programmers don't take months to fix critical
| security issues caused by their trivial mistakes.
| rtev wrote:
| Look at hackerone. They absolutely do. Many top-tier
| companies take 4-10 months to patch things that could be
| explicitly used for significant compromise. A company
| you've worked for has probably done it.
| [deleted]
| neodypsis wrote:
| Yes, and coupled with them taking months to address the issue
| makes me wonder if it is just carelessness or else.
| daniel-cussen wrote:
| There's companies that are just bad at some parts of the
| business. Myspace was like that, really slow programmers,
| reportedly. Like implementing things the executives knew they
| could do and weren't that hard, took them ages.
|
| In his essays, Paul Graham talks about this. If you are a
| company with no software brains at the top, the only way of
| getting ahold of competent programmers is luck. And business
| founders generally ruin their own luck.
| Lio wrote:
| Given Zoom's history of "mistakenly" doing things, I don't
| think your concern is completely unfounded.
|
| The FBI have previously issued warnings[1] about Zoom
| "accidentally" routing calls through China and for
| "accidentally" allowing CCP officials to monitor and end
| calls made outside of China they don't like[2].
|
| This is just the latest "accident" we've found out about.
| You'd be a fool to think there won't be more.
|
| 1. https://www.fbi.gov/contact-us/field-
| offices/boston/news/pre...
|
| 2. https://www.washingtonpost.com/technology/2020/12/18/zoom-
| he...
| webreac wrote:
| As a developer, this silly cryptography check would be very
| useful during development phases to avoid signing after each
| compilation. IMHO, they "just" failed to replace the
| development code by the production code during delivery. A
| simple mistake ;-)
| neodypsis wrote:
| I don't see how that would be the case here. Please note
| that the check is performed by the autoupdate software that
| ships with Zoom, not by the Zoom app itself.
| Sakos wrote:
| There is _no_ way this is anything other than intentional. I
| can 't imagine writing something like this in any of my code.
| It's "checking if the filename is correct" vs "reading from the
| file and verifying the contents".
| toddmorey wrote:
| This from the company that previously dropped a hidden,
| persistent webserver on every mac allowing Zoom to even reinstall
| itself if deleted.
| sascha_sl wrote:
| There really wasn't any other reason but marketing for buying out
| the Keybase team, was there?
| WesolyKubeczek wrote:
| The Zoom's insistence on using .pkgs when you can perfectly well
| just drag an .app from a disk image doesn't exactly inspire
| confidence.
|
| And yet we keep wearing those handcuffs, maybe out of laziness or
| a habit.
| frxx wrote:
| Stuff like this makes me downright angry. Because people not into
| IT think Zoom is now equivalent to online meetings and many
| events are held with Zoom too. Job interviews, etc. Most people
| don't have any idea that their software is so bad and they are a
| scummy company best avoided. I'm trying to let the people around
| me know, but mostly they don't care.
| AuthorizedHelp wrote:
| coffeeblack wrote:
| I never used Zoom. Why does Zoom need to be "installed"? Isn't
| it a web application?
|
| There are many video chat sites, all free for small groups and
| without the need to trust some random company that wants to
| execute code on your machine.
| kibwen wrote:
| It is a web app, there's no reason whatsoever to install the
| native version aside from the fact that the website uses dark
| patterns to obscure the existence of the web version.
| tiagod wrote:
| The native version is definitely more performant, from my
| experience.
| smallerfish wrote:
| The downloaded version has slightly different video
| processing to make you look better. It may be that it's not
| possible to do on webrtc.
| Arbortheus wrote:
| Zoom actually has in-browser WebRTC support, but they make
| such a concerted effort to hide this option. I can only
| assume they have some kind of incentive for wanting people to
| install a client on their machine. Tracking, analytics,
| metadata, who knows?
|
| If when you join a call (without zoom installed) you click
| the download button, then let the zoom installer start
| downloading, then press the "I had problems installing" (or
| some phrasing to that effect) button, finally the join
| through the browser button appears.
|
| Yes, you have to download the zoom installer executable every
| time you want to join a call.
| kevincox wrote:
| The more a company insists that I must use their native app
| the more I am convinced that I should stick with the safe
| web-app.
|
| Also to make the join via web easier you can try something
| like https://addons.mozilla.org/en-CA/firefox/addon/zoom-
| redirect...
| chedabob wrote:
| The browser version tends to lag behind the native one by
| quite a bit, and has some really annoying restrictions.
|
| For a long time you couldn't use your microphone in Firefox.
| gfxgirl wrote:
| That's why I don't install the app. It works fine in the
| browser and I don't have to install anything.
| spurgu wrote:
| For the longest time the web client was super glitchy
| (stuttering) on MacOS. Haven't used Zoom for maybe 2 years
| now though so things might've changed.
| lokedhs wrote:
| On the desktop perhaps, but I tried for the longest time to
| connect using a mobile browser and it just wouldn't let me.
|
| I ended up having to go to a computer to connect with using a
| browser.
| hef19898 wrote:
| The anti pattern of forcing apps down tge throats of mobile
| users should be illegal. Looking at you LinkedIn, Instagram
| and those others I missed.
| lostlogin wrote:
| I installed 'Banish' on iOS to get rid of the nagging
| dialogues. I haven't seen one since.
|
| No affiliation.
| madeofpalk wrote:
| No, it should not be _illegal_.
| hef19898 wrote:
| Why not? So that tech companies can collect more data?
| Because I don't see any reason why browser solutions
| aren't viable in the age of overpowered smartphones and
| 5g networks.
| mhluongo wrote:
| Just because you don't like something doesn't mean it
| should be illegal? Pretty obvious.
| hef19898 wrote:
| I gave you a reason why I think this pattern should be
| illegal under, e.g., the EU privacy laws. So what's your
| reason for believing it should be legal to force people
| to use an app tgat collects all kinda of tracking data
| about users over an equally fine browser solution?
| scarface74 wrote:
| Nah, that just means we will have a pop up every time we
| launch an app just like we do now with every web page.
|
| The last thing the world needs is yet another 99 section
| 10 chapter law by clueless lawmakers.
| madeofpalk wrote:
| What does this law actually look like? What's the
| legislation? "You're not allowed to link to a native app
| from a website"? Are you saying iOS universal links -
| twitter.com links opening in the twitter app - should be
| illegal?
|
| I don't understand how you can legislate against this
| without also banning a bunch of legitimate use cases.
| hef19898 wrote:
| We did it with browsers, didn't we? And we rightfully
| complain when MS is defaulting back to Edge after an
| update. Sure, LinkedIn, ask me once if I want ro use the
| app. Accept that I stick to the browser / website and
| don't make the website experience arbitarily worse on
| mobile just to nudge me into using your app. Same
| principle, and honestly a lilegit use case for cookies so
| that LinkedIn can remember my decision.
| WhyNotHugo wrote:
| Except for organisations which enforce e2ee. For end-to-end-
| encryption, only their desktop app works.
| happymellon wrote:
| Does the browser not support encryption?
| imron wrote:
| > but mostly they don't care
|
| Because the UX of other offerings is so poor and zoom for most
| part just works.
|
| I say this as someone who is aware of the security issues, but
| still prefer zoom over anything else.
| rvnx wrote:
| There is Google Hangouts and it works well
|
| The main "advantage" that I can see to prefer Zoom is that
| Zoom ("Zhumu") is considered by the authorities in China as
| safe, so it's not blocked there (which is convenient if you
| speak to people in China).
| ISL wrote:
| It may actually be a negative sign for security if the
| maintainers of the Great Firewall regard an application as
| safe.
| grumple wrote:
| Ironic that you say this. I have a MacBook pro and the zoom
| application just wouldn't start successfully one day,
| reinstalling doesn't help. But the web version and other
| video apps work fine.
| benreesman wrote:
| There is no panacea here that I'm aware of. We've been
| getting pretty good mileage out of a mix of Telegram,
| Discord, and Google Meet, all of which I prefer to Zoom, but
| none are crushing this and none are optimized for big video
| calls like Zoom is.
|
| Not surprisingly given it's gamer heritage, Discord is slick
| and fast for many-party voice and the present/screen-share is
| better than I expected, but video chat needs work and there
| are other nags.
|
| I have somewhat high hopes for Telegram because it usually
| does things well or not at all, but I also wouldn't want to
| try getting 20 people in a videoconference.
|
| I never liked in-person meetings with tons of people in the
| room, and one presenter, many listener video/screen broadcast
| is very achievable today without Zoom. Maybe it's a hard UX
| problem because it's a fundamentally flawed collaboration
| model, who knows.
| bombcar wrote:
| Zoom seems to be absolute tops in "join without having to
| fight with accounts" which is a huge feature.
| christkv wrote:
| Try out whereby.com the company is Norwegian as well so you
| avoid the ccp issues with zoom
| vnm wrote:
| +1 whereby is absolutely amazing, no-crap UX and great
| performance
| eastbound wrote:
| WhereBy is no-login, no-plugin conferencing tool. Albeit
| expensive now (They've been jacking up the prices regularly
| and show no sign of stopping), but it is entirely possible to
| make extremely simple webconf UX.
| tails4e wrote:
| Yes, we're transition firm zoom to teams, and as we're
| engineers, I'll sorely miss the screen annotation feature
| which works so well. Teams just added active anntoation and
| it totally sucks, the presenter can't interact with the
| screen while annotation is on. Sweet jesus why do that?
| rampatra wrote:
| You can give Presentify (screen annotation) app on Mac a
| try and see how it works for you.
|
| Link: https://apps.apple.com/app/presentify/id1507246666
|
| Disclosure: I made this app.
| tails4e wrote:
| How is interactive annotation handled? The zoom
| annotation let's amy meeting attendee annotate the
| presenters screen.
| FrenchDevRemote wrote:
| how is it better than google meet?
|
| the few times I used zoom there always was problems with
| audio, camera or people struggled to join
| seanhunter wrote:
| For one, Meet has consistently the worst picture and audio
| quality at least in my experience. I daily have about 4 or
| 5 zoom meetings and 1 or 2 meet meetings per week so it's
| not a small sample. On a day where I'm pumping out zoom
| meetings in perfect quality, Meet will be degrading the
| video to the point where I can scarcely recognize people
| and having audio sync problems. In the last couple of years
| I seldom have had "meet" meetings where at least one
| participant doesn't lose sync, lose audio or just get
| kicked randomly, where these occurrances are (anecdotally,
| in my experience) much less frequent for zoom. It gets
| particularly bad when you get above a certain number of
| participants.
|
| I don't recall meet being this bad a few years ago (I used
| to be at a company that used it for all internal meetings)
| so I don't know whether some infrastructure changes have
| occurred to make it so.
| azangru wrote:
| Does Google Meet have tools to draw/annotate during screen
| share?
| imron wrote:
| > how is it better than google meet?
|
| Doesn't require a Google account to login.
| WhyNotHugo wrote:
| You can join Meet calls without a Google Account.
|
| Zoom also requires an account to log in.
| bombcar wrote:
| Meet is annoying because I have to remember to sign out
| or open them in a private window if I don't want to leak
| details associated with the current gmail account logged
| in.
| imron wrote:
| Zoom doesn't require an account. All you need is the
| meeting number and password to join a call.
|
| And one of the recent Google meet offerings (not sure
| exactly which one but it was about a year ago) required
| an account before I could connect to the call. Perhaps
| it's different now.
| happymellon wrote:
| With Zoom it's optional, but the meeting creator can
| specify that it's mandatory so that you don't get drive-
| by bots.
| servercobra wrote:
| In every case I get worse audio and video through Meet than
| Zoom, and more stuttering. And similar issues with audio
| and camera, especially if people have more than one.
| macNchz wrote:
| I find the Zoom interface UX to be terrible, but keep
| coming back because it's way better in ways that matter
| once you're used to that.
|
| I've found that the screenshare quality in Zoom is rather
| strikingly better than in Meet, to the point that sharing a
| large screen with an editor full of text is frequently
| unreadable on Meet but perfectly crisp in Zoom.
|
| Also, Zoom does some sort of background noise cancellation
| that is really impressive. I don't know if other apps don't
| do it, or do it worse, but it's noticeable on calls (I use
| both Zoom and Meet daily). I was curious so I tested it
| from a coworking space recently: recording my headset mic
| in the open room I could hear voices, an espresso machine
| and some distant music pretty clearly. Joining a Zoom and
| doing the same and my background audio was genuinely
| silent.
| zainhoda wrote:
| Also the Zoom client has much better touch-ups and
| lighting controls. When I use Zoom now, I don't need to
| use my studio lights but when I do Google Meet or any
| other web-based one, half my face is in the shadow and
| there's no software way to fix it.
| Apocryphon wrote:
| Google Meet? Which one?
| yibg wrote:
| I can actually read the code when someone shares screen and
| scrolls. With google meet (whichever version), when sharing
| small dense font, things get mighty blurry when scrolling
| is happening. At least for me.
| ClassyJacket wrote:
| Do you mean Google Meet, or Google Meet (Original), which
| are two seperate apps?
|
| Or were you you referring to Duo, which is also called
| Google Meet now. Or Hangouts, the other Google video chat
| app which also exists for some reason? Or Google Hangouts
| Meet, which also existed? Or Google Allo?
|
| It's better than Google Meet because Zoom won't shut itself
| down in 6 months, replace Zoom with a different app with a
| different name, change the name, change the name again,
| then shut that down and repeat the cycle 6 months later.
| iainmerrick wrote:
| Most people don't actually care about or even notice that
| confusion.
|
| You go to meet.google.com and it works without too much
| hassle.
| cerved wrote:
| not on Firefox
| rvba wrote:
| > Most people don't actually care about or even notice
| that confusion.
|
| You are very, very wrong:
|
| 1) Old people get very confused even when the interface
| changes.
|
| 2) The changes are irritating even if you know Google
| products
|
| 3) Change for the sake of change (someone at Google wants
| to get promoted) is just a waste of time, especially as
| the products are half baked. Maybe you are very young and
| your time is worthless, but most people want products
| that just work, with a non confusing interface. Change
| for the sake of change is something that busy-bodies do
| to prove that they are useful
|
| 4) Google has killed its own products multiple times, so
| at some point the stuff just stops working. Why bother
| using a product that will not work?
|
| Seriously, it has been few years that _everyone_ knows
| that Google does its business wrong: those on top should
| be removed, since it is a lot of money lost. In both of
| marketshare lost and lots of programmers reinventing the
| wheel multiple times to offer a half baked product.
|
| Every few days I see people who cannot use Microsoft
| TEAMS (which has a poor interface) and I can easily see
| that if they used Google products, those constant
| unnecessary changes would make their lives miserable and
| make them less productive. Maybe reason why Google
| products are a joke in corporate environment.
|
| I dont really use Zoom, used it mostly to see how it
| works - and from technology perspective it can be full of
| holes, but from UI perspective it is much better than the
| competition. Also probably wont be shut down in 3 months
| like Google Meet Duo Allo v5.
| throwawaypcking wrote:
| > Old people get very confused even when the interface
| changes.
|
| That's a very ageist and ignorant comment. There are
| plenty of Tik Tok videos of young people getting confused
| over very simple things as well.
|
| Sometimes age can be related but being "old" isn't a
| sentence to being confused by UI/UX changes.
| lultimouomo wrote:
| This is the one redeeming quality of Meet, and it's worth
| a lot. I can click on a link that was sent to me and all
| the essential videoconferencing stuff will just work in
| my browser. Also in Firefox, regardless of what sibling
| says (I use it regularly on Linux and macOS).
|
| This is a technical feat that somehiw still escapes most
| of the other videoconferencing platforms (except maybe
| Zoom, but then they try to hide it as much as possible).
| geysersam wrote:
| My impression is that zoom has more features. Breakout
| rooms, predefined set of meeting hosts etc. But having to
| install the app on the computer is a pain. "I'm going to
| join this Zoom meeting starting now." "Nope, you have to
| update the app first." Is not fun.
| kevincox wrote:
| Meet has had breakout rooms for a year or two.
|
| Predefined hosts is a place that is lacking. In general
| Meet started as a "everyone is mostly trusted" tool which
| is way better for office meetings so their host controls
| are behind (but slowly being added). Zoom is by default
| "only the host is trusted" which is very annoying in my
| day-to-day use. (For example you can't have a weekly
| meeting because the "organizer" is on vacation and can't
| start it. You can't screenshare because the host needs to
| approve, you can't join before the host... Most of these
| can be changed by default in your settings but I'd course
| most people in my company haven't done this so we run
| into problems at least weekly and need to scramble to
| send around a new link and hope that we manage to get
| everyone into the same call.
|
| But that being said I think Zoom is still the better
| option for "untrusted" setups like seminars,
| presentations or other complex or large events. Meet is
| far better UX for meetings.
| smallerfish wrote:
| > This is the one redeeming quality of Meet
|
| What do you have against Meet? It's a better solution
| than Zoom. It doesn't have built in whiteboarding,
| granted, but for that you can use an online whiteboarding
| tool.
| surajrmal wrote:
| Google meet has jamboard integration for whiteboarding.
| Biganon wrote:
| But... Zoom's UX is absolutely terrible
|
| Half the options that should be on a meeting-basis are buried
| deep into the user settings, only accessible from the web
| interface, and they have confusing names and meanings. I've
| used lots of softwares, Zoom might be one of the worst when
| it comes to UX.
| aidos wrote:
| It's horrible. Especially if you're doing screen sharing /
| scribbling on screens all day. "The zoom dance" is my term
| for people constantly pushing those stupid little floating
| windows about.
|
| We switched to zoom though because the performance was just
| better than anything (we tried a boat load of tools - but
| most of them were just shiny saas offerings on top of
| Chrome). Now I'm on an M1 it doesn't matter as much, but
| zoom was the only thing that didn't totally kill our
| machines before that.
| hamburglar wrote:
| The zoom dance is real. I very frequently find myself
| pushing things around in vain because I am only
| dedicating a portion of my brain to the task and I can
| never quite believe that it's impossible to lay things
| out in a way that is actually usable. So there's like a
| 5% mental cpu task that's just constantly pushing things
| around due to this vague feeling that _obviously_ I will
| find the better arrangement. It _must_ be there, right?
|
| Zoom UI is horrendous. But it's also not quite as bad as
| teams, and everyone has learned to cope with it. So it's
| the best of an absolute shitpile. Teams will remain a
| complete joke to me as long as I am forced to play the
| "try to map initials to names" game in order to figure
| out who is talking. I don't know my coworkers by their
| initials, Microsoft. I don't know why you can't just show
| me actual names.
|
| Meeting UI people: here is a list of questions that I
| find myself constantly asking myself: who is talking? Who
| just finished talking? Who is in this meeting? Who just
| joined? Who just left? If you waste an entire screen on
| nearly information-free user tiles and make me open a
| separate window to answer these types of questions (or
| they are impossible to answer), I hate you.
| Kwpolska wrote:
| > Teams will remain a complete joke to me as long as I am
| forced to play the "try to map initials to names" game in
| order to figure out who is talking. I don't know my
| coworkers by their initials, Microsoft. I don't know why
| you can't just show me actual names.
|
| I'd say the expectation is that everyone sets their
| actual photo as their profile picture, that would
| probably solve your problem.
| AvocadoPanic wrote:
| Only if you already know what they look like.
| replygirl wrote:
| software can't solve for you not knowing your peers
| hamburglar wrote:
| I'm not asking it to help me know them. I'm asking it to
| use an identifier I recognize. On earth, we use names.
|
| And regarding profile pictures, I'd say 10% of the people
| I interact with on zoom have them, and 0% of the people I
| interact with on teams. These platforms should get over
| themselves and realize people aren't spending time
| customizing their profiles, because it's just not
| important. You're just a tool, zoom/teams. Try not to go
| wild with your fantasy of becoming a "virtual town
| square" that is integral to all aspects of life or
| whatever you are telling yourself internally. First goal
| is making meetings less of a pain in the ass.
| nostrebored wrote:
| In this case it absolutely can. Show me the name not the
| initial.
| beAbU wrote:
| Most of my teams meeting take place on client
| organizations, where I'm a guest of the directory, or
| just invited to the call. I never see profile pictures,
| and I cant find a place to edit mine.
|
| I'm almost willing to pay good money to someone who can
| explain how MS' user management works wrt belonging to
| multiple accounts/orgs/acive directories.
| throwawaypcking wrote:
| I like Zoom's easy to use UX. I can't stand the complex UI
| of Teams and it sucks I have to use it every day.
| imron wrote:
| > Zoom might be one of the worst when it comes to UX.
|
| For me, it's Teams. It's worse in almost every way.
| happymellon wrote:
| And somehow the team/group chat feature is worse that any
| other chat program I have ever used. Except maybe Chime.
| NGRhodes wrote:
| I feel most features in teams are worse than others or
| have major issues. These are issues I currently have with
| Teams:
|
| Search results that don't allow you to go to the specific
| part of long conversations. Wiki that doesn't even
| qualify as wiki. Integrated calendar that automatically
| tries to make you join meetings you have not yet
| responded to (with no way to configure not to happen).
| Inconsistent ability to quote reply to peoples messages.
| Hap-hazard method of starting meeting recordings (anyone
| can do it and with the latest update they become the
| owner instead of the meeting organiser). External guests
| can't access meeting recordings. Inserts non visible
| spaces into code you paste in and does not strip it
| properly when copying and pasting out. Emoji selection
| popup fails to load if you join a meeting with busy chat
| as loading new messages takes priority. Inconsistent
| loading of tabs when you join a meeting, so some people
| cant do Q/A or look at files (but can be loaded in a
| separate window even whilst the meeting is running.
| Bigger issues like high CPU usage (massively compared to
| Zoom) with lots of attendees and far more limited visible
| attendee screens (compared to Zoom).
|
| At the moment obvious defects seem to be added faster
| than they are removed.
| happymellon wrote:
| Oh the quoting is absolutely appalling, but on my Mac it
| is the only one out of the work chats that actually
| supports pasting an animated gif into the chat.
|
| You know where the priorities are.
| ratww wrote:
| Maybe they fixed it and I gotta upgrade, but for me
| animated gifs have been broken for a couple weeks.
| tormeh wrote:
| Teams is just so bad. If a company you're interviewing
| for has chosen to use Teams, what people do you think
| they choose to promote? What strategies to pursue?
| Clearly their decision making process is broken, and the
| consequences probably don't stop at using shitty
| software.
|
| I'm exaggerating a bit, but for me Teams is a real turn-
| off.
| pjmlp wrote:
| Teams made me love Slack, it is incredible how bad it is.
| iso1631 wrote:
| Teams is worse than zoom certainly, but it's better than
| Cisco WebEx.
|
| Slack used to be good - especially for just a background
| chat, but then they hid the "start a call" option away
| and pushed "huddles", which are far worse.
|
| There's a solid rule of thumb that most software that is
| good becomes worse. Product managers have to push new
| features in to justify their job, if the software was 75%
| good before, there's a 3:1 chance that the change will
| make it objectively worse, and even higher chance that it
| will break your workflow and cause you to take cognitive
| load away from important things to learn how to deal with
| it in a new way.
| ethbr0 wrote:
| At some point, companies need a CUCO: chief user
| consistency officer.
|
| "No, we're not changing that. Your changes don't
| meaningfully improve the product enough to offset the
| disruption."
| vladvasiliu wrote:
| Are there any other options that actually work well? At
| least Teams is "free", as in people already using
| Office365 don't have to pay anything.
|
| We use Teams at work, and I think it's an absolute pile
| of crap. But whenever I have to attend meetings using
| other systems, the experience is pretty much never great
| either.
|
| Zoom has a weird windowing system, stealing focus all the
| time, and shows notifications as actual windows (as
| opposed to using the notification system).
|
| Google meet sometimes squeezes my webcam image for some
| reason. It also transforms my PC in a jet airplane.
|
| Chime sometimes works, sometimes doesn't. Usually, it
| won't detect my microphone. If I refresh the page enough
| times, it will end up working.
|
| Webex mostly works, but it's sooo laggy. It also needs me
| to have the window focused if I connect too early to a
| meeting and am the first one there. If it's unfocused, it
| will not connect to the audio, so I'm left waiting around
| wondering why people are always late. And it insists on
| showing a bunch of useless crap around the main image. I
| know who's in the meeting, so if they're sharing their
| screen, I want to see that instead of their names taking
| up half the screen.
| bombcar wrote:
| At least on Mac you can tell Zoom to use Mac
| notifications now, and to use "dual monitor mode" even if
| you don't have two monitors, which seems to help.
|
| Of all the various meeting tools, Zoom is the best, but
| that's damning with faint praise.
| LightG wrote:
| Not exaggerating. I agree.
|
| As someone who is interviewing at the moment. I won't
| completely dismiss the company for using Teams (and
| expecting the interviewee to 'cope' with the crap
| experience) but it immediately puts that company in the
| "hmm, I'll do this interview for the practice and maybe
| they'll surprise me" camp ...
| vladvasiliu wrote:
| > Integrated calendar that automatically tries to make
| you join meetings you have not yet responded to (with no
| way to configure not to happen).
|
| Oh man, that calendar is such a shitshow, and it's also
| not only on Teams, but also on Outlook.
|
| It's able to detect some other conferencing software and
| add a "join" button, for example Webex.
|
| But, for some reason, it systematically fails to
| recognize Teams links sent from a company we work with a
| lot. If I click the "join meeting" link inside the
| invitation, Teams will open and join said meeting, but it
| never shows the "join" button on the event in the
| calendar view.
| Tsiklon wrote:
| Chime was/is dreadful - but calls were of decent quality
| on that and easy to use IIRC
| deaddodo wrote:
| > Except maybe Chime.
|
| I thought you were referring to the banking app for a
| second and was insanely confused.
| devteambravo wrote:
| It is. And all the other tool's UX's are MORE terrible!!!!
| Wowfunhappy wrote:
| UI [?] UX.
|
| Teams, Google Meet, etc all seem to fall apart on large
| calls with participants who have questionable hardware
| and/or wifi. Zoom works with those same people.
|
| This is based on my experience early in the pandemic, so
| it's possible the landscape has changed since then. We
| tried a bunch of different options at my company, because
| we explicitly didn't want to use Zoom, but Zoom _worked_
| like nothing else did.
| ethbr0 wrote:
| I think it's indicative that Zoom's genesis was from
| unhappy Cisco / WebEx engineers.
| https://en.m.wikipedia.org/wiki/Eric_Yuan#Career
|
| _" Upon arriving in the US, Yuan joined WebEx, a web
| conferencing startup, where he was one of the first 20
| hires. The company was acquired by Cisco Systems in 2007,
| at which time he became vice president of engineering. In
| 2011, Yuan pitched a new smartphone-friendly video
| conferencing system to Cisco management. When the idea
| was rejected, Yuan left Cisco to establish his own
| company, Zoom Video Communications."_
|
| Agreed, Zoom does shitty things. But everything else is
| worse.
| bkircher wrote:
| Ever used MS Teams?
| smallerfish wrote:
| Zoom's UX is horrendous. My biggest complaint is it logging
| me out all the damn time because I switch between laptop
| and desktop fairly regularly. But its windowing UI also
| drives me nuts. Their timing and marketing was clearly
| excellent, but it's a shame that Teams is what's eating
| their portion of the pie rather than Meet.
| hedora wrote:
| So, your top three choices are Google (weird ties to the
| US state dept), Microsoft (lobbied for cloud act,
| acquired linkedin and github so they could join the data
| with mandatory windows and office telemetry) and an
| independent company with weird ties to the Chinese govt.
|
| Do you really have a strong opinion about which one is
| the least bad choice?
| JadeNB wrote:
| > So, your top three choices are Google (weird ties to
| the US state dept), Microsoft (lobbied for cloud act,
| acquired linkedin and github so they could join the data
| with mandatory windows and office telemetry) and an
| independent company with weird ties to the Chinese govt.
|
| > Do you really have a strong opinion about which one is
| the least bad choice?
|
| I suspect that, if you're in the US or China already
| (which, just to say it explicitly, I recognize does not
| apply to everyone on HN), then you perceive a meaningful
| difference in whether any improper use of data will
| expose that data to the US, or to the Chinese,
| government. Even if your personal threat assessment finds
| no difference in those risks, then you probably at least
| have a strong opinion whether it's better to have your
| data improperly exposed to a government of whatever
| country, or to a private corporation.
| edgyquant wrote:
| Nope but the last one is obviously the most bad choice.
| geraldyo wrote:
| How so?
| smallerfish wrote:
| > Do you really have a strong opinion about which one is
| the least bad choice?
|
| Yes, the one without a desktop install is clearly the
| best solution.
| mccorrinall wrote:
| Are you sure the logging out when switching issue isn't a
| setting by your organization?
| softwarebeware wrote:
| Same here. Particularly the windowing. On a dual-screen
| setup, Zoom controls go off to other places and do not
| stay where they were left. I've had multiple experiences
| of not being able to find the Zoom buttons while I'm on a
| call.
|
| Second, it drops you out of meetings sometimes while you
| are screen sharing, and gives you no way to know. It's
| sporadic on my machine whether the green highlight/frame
| shows up on screen sharing to indicate that the content
| is still being shared.
| thesumofall wrote:
| Their UX seems really bad. E.g., they changed the default
| behavior of the title bar, auto-hide critical buttons such as
| mute/unmute, etc.
| christophilus wrote:
| I'm one of those who hates Zoom's UX. They use dark patterns
| to try to trick you into installing rather than using the web
| client. And their web UI is... not great.
|
| I've had better experiences as an attendee on other software.
| (I think one was Gotomeeting). Works flawlessly in the
| browser. No dark patterns like the way Zoom tries to trick
| you into downloading their malware.
|
| And the interface was superior, in my opinion. No idea how
| good / bad the presenter UX is, though.
| okamiueru wrote:
| Wait. Is it possible to use the Web client? I asked
| external people who had set up a zoom meeting to reschedule
| on Google meet, because I couldn't for the life of me
| figure out how to use their web ui.
| kevincox wrote:
| Yes. The join via web button should join after you click
| the regular "join" link once. If you don't have zoom
| installed it will just pop up not working then you can
| join via web.
|
| I also use https://addons.mozilla.org/en-
| CA/firefox/addon/zoom-redirect... to fix up the URL
| automatically.
| tomsmeding wrote:
| It is possible, but it misses features. For example, the
| thing that I ran into recently is that web zoom cannot
| switch between multiple camera's of another person on the
| call -- e.g. if they have some fancy conference room
| setup.
| Schroedingersat wrote:
| jitsi just worked every time i've used it
| lokedhs wrote:
| Quite honestly I would be love to hear an argument as to
| why anyone would use zoom over jitsi. I'm not trying to be
| controversial, and I readily admits I've only used zoom
| maybe twice, but I saw nothing that was better than jitsi.
|
| I also had performance issues on zoom, but I'm willing to
| ignore that since most other people don't seem to mention
| those issue so that's probably on me.
| Kwpolska wrote:
| Previous job was using self-hosted Jitsi. And it was
| often a trainwreck, with random disconnections, terrible
| video quality (and we didn't use it very often), some
| people ~always displaying "connection lost" even though
| we could hear each other fine, some people always having
| connection issues and being disconnected after a few
| seconds. Zoom and Teams are much more stable.
| fold3 wrote:
| My aunt that do remote conference a lot told me jitsi is
| slow and ureliable? She's not very tech savy so maybe she
| had a bad experience at the time when lockdown happen and
| the servers might have been overloaded.
| Schroedingersat wrote:
| Main downsides I knw of are a slightly worse codec, and
| in webrtc mode bandwidth needs to scale with participants
| so for large meetings you need to pay for hosting
| somehow.
|
| Neither are reasons not to use it as a default first
| option.
|
| Also matrix has voice and video now and there's big blue
| button.
| lokedhs wrote:
| I've never used voice in Matrix, but I was sure that it
| was implemented using Jitsi on the backend?
| Schroedingersat wrote:
| Element had a jitsi plugin i think. the matrix
| voice/video is new and i only used it once
| designium wrote:
| I just use Zoom with Chrome via browser. No need to install
| it.
| fishywang wrote:
| I only use Zoom with chrome (because I don't allow their
| apps anywhere near me) and they are just barely usable
| there.
|
| They made that very hard by pushing their desktop app. They
| also broke audio on Linux very often. Another long running
| bug is that after you've muted yourself in the meeting for
| long enough they start to think you did not give them
| microphone access and refuse to let you unmute yourself.
| shaan7 wrote:
| Yup. The thing I absolutely love about Zoom is how easy it is
| to switch between mics and output device. Every other
| conferencing tool needs you to go to Settings > Voice and
| then change it. With Zoom, just click the arrow next to the
| mute button, select device and voila!
| ryukafalz wrote:
| Pretty sure Jitsi lets you do this as well.
| m1gu3l wrote:
| Really don't know why this setting isn't always up front
| and center just like the mute button. With just the default
| audio interface i have a few options and a lot of us have
| more than just the default interface.
|
| While we are at it why can't I control what audio
| interfaces are available to a specific program on a program
| by program basis? No, I will never want to use Steam
| Streaming Audio or my Oculus quest mic on a webex/zoom.
| Ever.
| MereInterest wrote:
| I can't stand this feature, because it overrides my OS-
| level choice. If I select my headset as the microphone to
| use, then I expect it to be used. But Zoom might use a
| different microphone, so I need to change it there as well.
|
| In addition, even if I select "System default microphone",
| that doesn't always work correctly. As far as I can tell,
| that option doesn't mean to attach to the default source.
| Instead, it means to attach to the same source that is
| currently bound to the default source. If I change the
| default source later, Zoom doesn't get moved along with it.
| mijoharas wrote:
| Some recent update of zoom and or pipewire made this
| absolutely broken. I need to manually go and change my
| Bluetooth headset source from A2DP to HSP before opening
| zoom or it crashes and I can't select any microphone.
|
| It's insanely annoying. Zoom has caused more crashes ob
| my machine than any other piece of software.
| shaan7 wrote:
| True. I keep it at "System default microphone" but its
| not 100% reliable. BUT, that is also the case with every
| other conferencing tool as well (Meet, Teams etc). At
| least in Zoom its easier to quickly override it when
| things go south.
| wil421 wrote:
| Same issues here. I don't care that my dock has a mic
| port that Zoom and Teams think they should automatically
| use. Use the damn system setting for my hardwired headset
| mic.
| shaan7 wrote:
| Yeah the dock thing sucks. My workaround is to
| permanently disable the dock (and the webcam's) mic
| device.
| scarface74 wrote:
| My wife had a mixer attached to her Mac where she plugged
| in her phone for music and her wireless mic when she was
| teaching online dance classes during the height of Covid.
| She absolutely needed to be able to switch to the mixer
| which registers as a sound input device separate from
| system settings when she was doing anything else.
| [deleted]
| ajkjk wrote:
| It seems fine to me. Good, even. It's not crap like video chat
| apps used to be.
| atoav wrote:
| As a media tech guy at an university: everybody keeps saying
| that, but most other systems we tried are _also_ not crap
| like they used to be.
| [deleted]
| m-p-3 wrote:
| I live somewhere where bilingualism is really strong and we
| need to offer simultaneous/live audio interpretation in both
| languages for some important meetings, and for now Zoom is
| mostly the best option on the market for that, nothing comes
| really close.
|
| We use Google Meet for everything but those meetings, because
| Google is still lacking on that aspect. At least they added
| breakout rooms and polls, but there's still work to do, like
| preconfiguring polls before the actual meeting takes place,
| etc.
| pokstad wrote:
| I remember the first time I used Zoom years ago. I was
| interviewing with a company and they asked me to join a Zoom
| call. When I went to the website to install it, it seemed like
| a poorly branded product and I had this concern I was
| installing malware. When I opened it for the first time the UI
| felt mediocre and I was sure at the time that I had compromised
| my computer.
| guiriduro wrote:
| > Stuff like this makes me downright angry.
|
| Why? Just uninstall Zoom.
| npteljes wrote:
| That doesn't fix any of the problems OP has.
| amelius wrote:
| How did Zoom defeat Skype in terms of userbase?
| Arbortheus wrote:
| It's kind of incredible, Skype had a 10 year head-start and
| still lost.
|
| But really, much of Teams was built upon Skype, and that is
| the dominant market player by a long shot.
| pier25 wrote:
| Teams is dominant?
|
| Do you have any source on that?
| Fill1200 wrote:
| Skype was originally built on P2P, so it couldn't work in a
| group chat and bad for mobile phones. That's the reason Skype
| fell behind other chat apps.
| happymellon wrote:
| Skype was absolutely awful for many years. I'm trying to
| remember all the things that were bad, but I remember that
| they reinvented the app twice, so that everyone could only
| talk to people on the version of the app they were on.
|
| They left Linux users in limbo, while Zoom worked for
| everyone.
|
| They couldn't handle more than a couple of people in a call.
|
| They also had Lync which was rebranded as Skype, so you also
| had other bad software masquerading as Skype which wouldn't
| have helped their image.
|
| You couldn't share a meeting URL and have the call in a
| browser for the longest time.
|
| They only started to try again after Zoom picked up being the
| default word for video calls.
| unsupp0rted wrote:
| At some point a few years back, before Zoom was really big,
| Skype changed their entire UI _and_ UX into Snapchat or
| Instagram... it went from an app for communicating to an app
| for looking at people 's updates... or something? I have no
| idea what its objective became. I doubt Skype knew either.
|
| That's when I switched away.
| klausjensen wrote:
| By Skype getting gradually worse with every release. It is
| mindboggling how it is WORSE than the Skype I used 15 years
| ago in every way I can think of.
| imgabe wrote:
| Google Meet has never worked for me. Not once. Across many
| browsers, OSes whatever. It simply does not work.
|
| MS teams I think worked once.
|
| Skype is ok.
|
| Zoom works every time.
|
| Want people to use something else? Make a thing that works.
|
| Edit: if you have also had problems with everything besides
| Zoom have you also ever held a security clearance with the US
| government?
| fezfight wrote:
| Not to be antagonistic, but what the hell is wrong with your
| computer? In the old days, we'd say PEBCAK.
| imgabe wrote:
| Honestly, no idea. People keep suggesting Google, so it
| must work for some people. But every time I try it,
| different computers, different locations, no matter what,
| it's so laggy it's unusable.
| fezfight wrote:
| Do yourself, friends and family a favour and stop trying
| on different computers. You're installing spyware on all
| those machines.
| Kaze404 wrote:
| Google Meet is a browser app.
| rnk wrote:
| Sorry but it's likely something is messed up with your
| computer or your internet connection. It works for
| billions of people, something is off. Google meets is not
| some inherently not-working piece of software.
| imgabe wrote:
| Different computers, different internet connections, even
| in completely different parts of the world. Maybe Google
| just has a vendetta against me.
| boondaburrah wrote:
| weirdly for me google meet is the only one that works and
| everything /else/ has problems, especially discord.
| enlyth wrote:
| This kind of mirrors my experience, all the other apps are
| wonky or provide a worse experience. For example with Slack,
| if we (UK) video call with colleagues from the US, it's
| usually laggy, pixelated and delayed, so we have to use Zoom.
| eddieroger wrote:
| Zoom may be kind of scummy, but the tradeoffs they made
| created a program easy enough for grandparents and CEOs alike
| to use, and that counts for something. The first time I used
| Zoom with some family members during the pandemic, they were
| audibly impressed with how easy it was, and these were people
| who use FaceTime regularly. The bar is reset now.
| _def wrote:
| I use Google Meet almost daily without problems with Ubuntu
| and Firefox
| OtomotO wrote:
| Counter example: installed zoom years ago for a job interview
|
| Didn't work (Linux, Wayland even). We switched to discord for
| the interview.
|
| Uninstalled zoom, never installed it again.
|
| All my clients use alternatives and I am sooo glad.
|
| I should clarify: my clients range from multi billion dollar
| companies to small to medium sized ones.
|
| The big ones use teams or such, the smaller ones are more
| flexible
|
| Wherever we can, we use jitsi
| throwawaypcking wrote:
| On Ubuntu Linux (for years) I've used the following without
| issue, ranging from multiple times to every day, video and
| audio:
|
| Hangouts Google Meet Skype Zoom Teams
|
| Also, Wayland had issues years ago, that may have been
| related to the issue you experienced.
| OtomotO wrote:
| I am on arch for over 10 years and I had issues with
| audio. They could hear me, but I couldn't here them. Not
| on speakers, not on headphones.
|
| We even tried X11, just to make sure... No idea why I
| mentioned wayland, I blame it on the temperature, sorry!
| JumpCrisscross wrote:
| I install it on my iPad for video and otherwise dial in.
| Haven't found the need to install it on my computer.
| beagle3 wrote:
| FYI, it also works on modern Chrome and Firefox (but not
| Safari last I checked). More CPU intensive and a few missing
| features compared to the native client - but does work, and
| even works well.
| comboy wrote:
| It's a standard sequence for years now. Docker, rails, ring..
| most popular things. Make it work anyhow, optimizing for best
| user experience, do all the bad things along. It gains
| popularity, some reasonable people join in making insides
| better. Then because of popularity it gets some scrutiny and
| some security holes are getting fixed. Of course, only those
| which could negatively impact its image.
|
| Sometimes you end up with something quite decent, sometimes
| there's no one with enough power in the company who can rebuild
| it properly and it's just trying to make a stone out of sh.t.
|
| If you are trying to do it properly from the start you are in a
| lost position. You need way more time, more money and better
| people to end up with something that looks the same for an
| average user (in most cases, for a few products it may pay
| off). You iterate more slowly, and you can be copied before you
| acquired enough user base.
|
| I hate it. Marketing wins over merit everywhere currently.
| shuntress wrote:
| You are discounting the "merit" of simply existing.
|
| Bad software that solves my problem _now_ is almost always
| going to beat great software that might eventually solve my
| problem.
| comboy wrote:
| Many people choose worse reward rather now than better
| reward later. It's rational in many contexts. The problem
| is that we are unable to jump out of these local minima.
|
| Just as in coding, when you have a problem and you're
| stuck, you look for a solution. But it's very hard to learn
| that there's some better solution to a problem that you've
| already solved.
| chris_wot wrote:
| The update says that Zoom said it was "newly reported". The
| article says it was reported eight months ago!
| [deleted]
| makeworld wrote:
| Another day I'm happy to run Zoom through Flatpak.
| thrillgore wrote:
| Zoom is the only Video Conferencing system that, to my knowledge,
| uses a kext for the audio support. Why the hell does it need a
| Kext?
| Animats wrote:
| Why does Zoom need root access at all? That's the elephant in the
| room here. Zoom should be able to run in a sandbox.
| lights0123 wrote:
| To auto-update without requiring authentication every time.
| Useful for multi-user or enterprise setups where the current
| user may not have sudo access. Chrome and Firefox do the same
| thing.
| lizardactivist wrote:
| With all the past peculiar security issues in macOS, that happen
| to pop up somewhere else in the months after it's "fixed", I
| think Apple are just as sketchy and unreliable as Zoom.
|
| Zoom and Mac are perfect for eachother.
| krono wrote:
| Nothing good has ever come from apps that required admin
| privileges to install for no obvious reason. They either abuse
| the rights, or end up with massive security holes that are
| completely neglected for months or longer.
| georgelyon wrote:
| The one thing that has come of this is that products that do
| this have 0.5% less friction (they can auto-update quicker),
| achieved this faster and with less engineering effort (no need
| for a clever workaround, just use the biggest hammer), and have
| 0.5% less customer support burden (since everyone is on the
| latest version all the time). As a result, this can help a
| product dominate their competition the way Zoom has. I say this
| as a security conscious person who wishes this type of app
| would just go away, but has worked in the industry long enough
| to understand the economic realities.
|
| Honestly, this is the number 1 confounding factor for me in
| terms of the "app stores should be more open" argument. Sure,
| Apple is stifling innovation in phone applications by
| disallowing this type of thing, but also the Zoom app is much
| better behaved on iPhone because it has to be. Personally I am
| happy trading off some convenience for security, but I am
| unsure if there is a "correct" answer here. My personal hope is
| that VMs will become useful enough that it will become viable
| to have a crude per-shitty-application sandbox for folks that
| are security conscious. I already have done this with tools
| like docker from time to time, which admittedly isn't a great
| experience.
| amelius wrote:
| Indeed, it's crazy that some OSes even make this the default
| way of installing applications (i.e., become admin -> then
| install)
|
| E.g. Unix was built around the idea that other users should not
| be trusted but applications can be trusted; it is becoming
| painfully clear that this idea is wrong.
| sofixa wrote:
| Zoom needs a ton of probably admin rights required access for
| it's features - raw access to mic and camera, screen sharing,
| remote control, etc.
| thejosh wrote:
| If the app needs to access a feature, ask for it via the
| native app, isn't that what phones do? (I think?)
|
| Chrome has to go through the hoops on Mac every time it
| updates to re-allow it in Privacy Settings for Google
| Hangouts to work. It's such a pain.
| ben174 wrote:
| Then Zoom should ask for those permissions, like every other
| app does. If we make it an admin, we have problems like
| these.
| krono wrote:
| Nope, that's what the protected resources API is for.
|
| https://developer.apple.com/documentation/bundleresources/in.
| ..
| sofixa wrote:
| Doesn't Zoom predate these by like years?
| [deleted]
| grishka wrote:
| You never needed root for any of this on macOS.
| sofixa wrote:
| Even remote control?
| grishka wrote:
| Even remote control, or, in general, input
| interception/injection. That's done via accessibility
| APIs I believe, and these do need to be enabled once per
| app in the system preferences, and this does require root
| password or touch id, but a well-behaved app would not
| bypass that. A well-behaved app would guide you through
| granting it this permission in a supported way.
| dudus wrote:
| So a well behaved app is harder to install by your own
| standards. Not surprised Zoom skipped that for a more
| streamlined setup. UX is king
| IshKebab wrote:
| The only thing I can think of that Zoom needs root for is its
| (very helpful!) offer to restart Mac's audio subsystem when
| it crashes (which it does fairly regularly in my experience).
|
| That said, it could just ask for your password at the time.
| voxadam wrote:
| I thought the audio subsystem in Mac OS was the best of the
| bunch (Windows, Mac, and Linux). At least that's what I was
| told by my old audio geek friends that swore by Mac OS. Why
| would a video chat app need to be regularly restarting a
| crashed subsystem? Also, even if the subsystem crashed why
| wouldn't launchd or the kernel take care of restarting it?
| IshKebab wrote:
| It might be better in terms of latency (I have no idea)
| but it's way buggier than Windows'. Crashes all the time
| for me. Plus it has some stupid missing features like
| volume control isn't implemented for HDMI audio (it is on
| Windows) and you can't capture the audio output - at
| least without fairly extreme hacks. It's a lot easier on
| Windows.
|
| I haven't used sound on Linux for a long time but when I
| did it was in a completely different league to Mac and
| Windows - in a bad way.
| happymellon wrote:
| > I haven't used sound on Linux for a long time but when
| I did it was in a completely different league to Mac and
| Windows - in a bad way.
|
| I am not a sound engineer. I don't do music composition.
| I am simply a user who wants things to work.
|
| Sound hasn't been an issue for me in Linux (as a user)
| for a long time. There was a period when the audio system
| was replaced with Pulse, which was terrible as they
| published Beta software to end users, but that quickly
| fixed itself and we are talking 20 years ago. Linux audio
| has been by far the best for usability for me.
|
| I also understand that the latency issue has been
| dramatically improved over the decades with the current
| situation with Pipewire being excellent. If it has been a
| long time since you have used Linux sound, then just be
| aware that it is not the same as it was.
|
| My Mac refusing to adjust the volume via HDMI I assumed
| was a feature to push towards buying an Apple display.
| christophilus wrote:
| Sound has worked better for me on Linux than it did on
| Mac and Windows. Albeit, I haven't used Windows in 5
| years or so.
| sofixa wrote:
| Idk about latency but UX wise it has some weird
| limitations - you can't mark an external audio jack
| connected device as input or output only, with the weird
| result that when i connect my external microphone it
| considers it an output too, and automatically switches to
| it as output too, which of course doesn't work. Windows
| and Linux ask me what did i just connect and adapt
| accordingly.
| krono wrote:
| Here's a workaround, it's ridiculous and probably a bug
| (any Apple SEs in the audience please move along, nothing
| to see here) but it works:
|
| - Open the "Audio MIDI Setup" app that comes pre-
| installed with the OS
|
| - Bottom left plus icon > "Create Aggregate Device" and
| optionally name it
|
| - Add your built-in microphone to this new device by
| dragging it from the sidebar to the left
|
| - Open your sound settings, and select the aggregate
| device as your main sound input
|
| After this it should no longer change the main input
| device when you connect something else.
| throw_m239339 wrote:
| It is the best, it's low latency and very stable contrary
| to Windows shitty high latency direct sound API which is
| a complete mess. So much that Steinberg had to develop
| some respectable universal audio drivers for windows
| called ASIO, Microsoft never cared about the issue.
| exyi wrote:
| Even web apps have access to these (when they ask for it)
| dikaio wrote:
| Agree, Dropbox is another app that asks for admin privileges.
| NegativeLatency wrote:
| Been using maestral.app for my Dropbox client and it's been
| fairly good. (Make sure you backup your Dropbox first as it
| corrupted my photos library)
| kurupt213 wrote:
| 'Corrupted my photos library'
|
| 'Been fairly good'
|
| Those can't both be true
| NegativeLatency wrote:
| No prompts to ask for the root password though
| __david__ wrote:
| It's frustrating because the App absolutely doesn't need it. I
| use the native .app, but I've never run their installer.
| Instead you can just unpack it using command line tools (I even
| wrote a script to do this [1]) and... it runs just fine! No
| privileges, no special installation. As best I can tell, the
| installer is there to install a bunch of ancillary nonsense.
|
| I did one other thing when I discovered their app auto
| installing a launchd auto-update service: rm
| -rf ~/.zoomus sudo touch ~/.zoomus
|
| This makes a file with root permissions where they hide their
| auto-update script directory. This causes their code to
| (silently) err out and viola, no more launchd junk.
|
| [1]:
| https://gist.github.com/caldwell/c212119fffd92a1d706c0a9b00f...
| ratww wrote:
| A lot of software has moved from using dmgs to mpkgs, and
| apart from some terribly written apps that need some hackery
| in PostInstall scripts, most of them don't really care about
| it.
|
| The UX for packages also sucks. With DMGs you just mount and
| then drag to the Applications folder... even the most basic
| macOS users have done this.
| ris wrote:
| > No privileges, no special installation
|
| It still has way, _way_ more privileges than a webapp. And
| arguably, if you have all your valuable information in a
| single user account, it has the crown jewels already, no
| admin needed.
| anyfoo wrote:
| Note that if SIP is enabled (the default), "root access" does not
| mean full compromise. On macOS, root is far from being as
| privileged as it was in the old days of UNIX yore. (Even on Linux
| it does not have to be, but my impression is that on most
| distributions it probably still is.)
|
| Just because you're root does not mean you get any entitlement
| you want, or arbitrary access to the whole filesystem, arbitrary
| memory access (a la /dev/(k)mem), or can replace the kernel just
| like that.
|
| (That's also probably why you don't hear of iPhones being
| "rooted", but rather "jailbroken". Just being root on an iPhone
| wouldn't do that much.)
|
| Make no mistake, this is still a privilege escalation attack and
| needs to be fixed.
| jbverschoor wrote:
| I don't need root access.. just your .ssh dir
| hk1337 wrote:
| You're going to need my U2F key too.
| ssizn wrote:
| Good luck bypassing my CGNAT ;)
| jbverschoor wrote:
| Well.. with ipv6, there's no need to nat anymore
| aidos wrote:
| Though you should keep your private keys protected by a pass
| phrase.
|
| Top tip for people that use 1Password: I've discovered
| recently that you can run it as an ssh agent. That way your
| keys never leave the 1password app.
| NavinF wrote:
| Either you're forced to type in your password 100 times a
| day (so the rootkit has to wait until you type it in) or
| you use ssh-agent and your decrypted key is in memory for
| all to see.
| aidos wrote:
| Judging by the downvotes, my suggestion isn't great,
| though it does seem a _tiny_ bit better.
|
| I was under the impression that 1password uses secure
| enclave on the Mac and that it only decrypts the key as
| it's needed. I guess depending on the implementation the
| decrypted key could be in memory for a moment - or maybe
| longer.
| danieldk wrote:
| Indeed. Use the Mac's Secure Enclave [1] or a Yubikey,
| preferably with Touch ID or touch confirmation on a YK.
|
| https://github.com/maxgoedjen/secretive
| snowwrestler wrote:
| The GP said they just need access to your .ssh directory
| (not root access, no mention of a root kit). A pass
| phrase on the key is a valid mitigation for that level of
| access.
|
| You don't need to type it, you can store it in a password
| manager and copy/paste, which is pretty fast. I do it all
| the time, it's not a big deal.
| NavinF wrote:
| Ok fair, but IMO there are few threat models where that
| would make a difference. In practice the attacker can
| just edit your bashrc and alias ssh-agent to log the
| password. Same for the password manager. Btw user mode
| rootkits are a thing and they typically don't need root
| despite the name.
|
| If attacker code can run under your user, you're kinda
| screwed.
| fulafel wrote:
| This would be just a minor speed bump if the adversary has
| control of the user account.
| woadwarrior01 wrote:
| And I'd though everyone else also kept their gpg and ssh keys
| on Yubikeys[1].
|
| [1]: https://github.com/drduh/YubiKey-Guide
| hk1337 wrote:
| I don't store them on it but I do require it to use it.
| danieldk wrote:
| Or in the Secure Enclave on Macs.
|
| https://github.com/maxgoedjen/secretive
| ddtaylor wrote:
| Can't SIP just be turned off by using root?
| przemub wrote:
| No - you need to boot the system into the recovery mode so
| you would need the exploit to be working in that mode.
| eu wrote:
| Tried `rm -rd /` as root on a Mac once. I didn't expect it to
| boot just fine after :)
| hungryforcodes wrote:
| So what DID happen after? :)
| userbinator wrote:
| I read your first 8 words and was momentarily confused because
| I thought you were referring to
| https://en.wikipedia.org/wiki/Session_Initiation_Protocol , and
| can indeed join Zoom meetings with a standard SIP client, but
| it's an optional paid feature --- nonetheless likely to be
| available in a corporate environment. Look for the IP address
| to dial in meeting invites to see if you have that option.
| tedmiston wrote:
| SIP is System Integrity Protection
|
| https://en.m.wikipedia.org/wiki/System_Integrity_Protection
| usrnm wrote:
| You still need some way to be able to manage the system and
| have unrestricted access to admin stuff. Moving the problem to
| some other place doesn't really solve it
| anyfoo wrote:
| Well if that other place is having to have the device in
| physical possession, and having to enter the admin password
| in person, before you can e.g. replace the kernel or critical
| system libraries...
|
| https://help.apple.com/pdf/security/en_US/apple-platform-
| sec...
| wonderbore wrote:
| Gotta thank Zoom for supplying a new excuse to not install Zoom
| on my Mac. I've been using it from iOS every time I had to and
| then deleting it afterwards.
|
| If anyone asks me when I'm on my phone, I tell them I don't trust
| Zoom.
| vbezhenar wrote:
| Why people install Zoom? You can use it from browser. I had to
| use it few times and it worked good enough.
| nicce wrote:
| Zoom tries its best to make people install it. You have to
| click quite many times before it allows browser session. The
| information is also quite hidden.
| vbezhenar wrote:
| Not really. You have to click "join" and then additional
| hyperlink appears which you have to click once again. Yes,
| not super-obvious, but you don't need to click many times. I
| agree that this feature is not well presented, but hopefully
| word of mouth would help here.
| SulphurCrested wrote:
| "But because of a subtlety of Unix systems (of which macOS is
| one), when an existing file is moved from another location to the
| root directory, it retains the same read-write permissions it
| previously had."
|
| And ownership. (The sentence before that suggests "root
| directory" here means "directory owned by root".) The permissions
| on the directory apply only to the file's directory entry, not
| the file itself.
|
| This isn't a "subtlety", it's how it works, and no-one who
| doesn't understand this should be writing macOS installers.
|
| The correct approach is to open the file for read and copy its
| bytes into your private area. Only then check the cryptographic
| signature. Just renaming into your private directory isn't
| enough, even if that directory has no read or execute access to
| other users, because the attacker could have opened the file for
| write access before you did the rename.
| pleb_nz wrote:
| I might be misunderstanding what you are saying, but it sounds
| like a lot of reliance on people knowing and wanting to do the
| right thing?
| jacquesm wrote:
| Most of unix is like that though.
| hungryforcodes wrote:
| This cannot be said enough.
| zbird wrote:
| I'm not sure what you're suggesting. Would you go to a doctor
| who doesn't know or want to do the right thing?
| whatshisface wrote:
| Yes, and the way you'd end up doing that is by not having
| doctor telepathy.
| pleb_nz wrote:
| So how do you prevent bad actors from abusing this and/or
| train every developer on the planet to ensure they do they
| follow the right processes.
|
| Sounds like its something that probably happens a lot and
| will continue to happen a lot?
| InitialBP wrote:
| I'm not sure about all languages but this actually caught me by
| surprise. When you do a 'mv' command (tested on macos) it does
| not retain file permissions by default. You actually need to
| pass a special flag in order to do so.
|
| Objective C does retain perms by default using some common move
| techniques.
| dmd wrote:
| What? Yes it does. You are confusing mv and cp.
| rileymat2 wrote:
| This is a pretty good example. Sure, we should know our
| tools, but This is not intuitive behavior if you don't
| know.
|
| https://superuser.com/questions/101676/is-there-some-
| differe...
|
| It is not until the last comment of the accepted answer
| that you get to the difference in permissions. (along with
| the answers that are not accepted as best)
| Linda703 wrote:
| baxtr wrote:
| I have to admit: I hate the zoom experience. I use Chrome to
| avoid installing the app on my Mac. They use some dark patterns
| to force the app on you, but you can use zoom in the browser.
| However, you can't use any backgrounds unlike google meet, which
| again is a way to force you into their app. These patterns alone
| show what kind of company you're dealing with.
| coconut_man wrote:
| If I switch to other tab while using the Zoom web version in
| one tab, all the video of everyone in the call disappear when
| go back to the Zoom tab, it's really annoying and a dump way to
| nudge people to switch to the app.
| modzu wrote:
| i could never bring myself to trust the app, so i made a
| browser extension to make using the web version less painful
| (skips the dark pattern page where the "join from browser" link
| is often hidden).
|
| its open source so if ya dont trust _this_ installer either,
| grab it from GitHub, its only a few lines of code :) hopefully
| others find it useful:
|
| https://chrome.google.com/webstore/detail/zoom-web-launcher/...
| wodenokoto wrote:
| In zooms defense, backgrounds in meet is a great way to stress
| test your laptop fans max capacity.
| baxtr wrote:
| Fair point. Then again, I think users are mature enough to
| make this trade-off decision by themselves.
| origin_path wrote:
| But you installed Chrome even though it does the exact same
| thing (runs an auto update Daemon with admin privileges, at
| least in Windows). Meet works well in Chrome because Google
| just adds whatever their apps need to html5. Other companies
| don't have that option. Seems kinda unfair to insist that
| everyone uses Google's app runtime otherwise they're guilty of
| "dark patterns".
| christophilus wrote:
| I trust Chrome, Brave, and Firefox more than Zoom, by a
| lightyear or so.
| baxtr wrote:
| Yes. You're right. I don't feel good about it either. Zoom
| didn't work well in safari last time I tried. And avoiding
| zoom is really difficult these days.
| dylan604 wrote:
| I use Zoom in FF on macOS daily, and have not had any of
| the above issues. I fire up the Zoom meeting in a browser
| tab, and then flip back and forth between tabs and windows
| with no negative results to the Zoom tab's functioning.
|
| Every time I have to relaunch FF after updates, the Zoom
| webpage forces me to download their installer (which I
| delete without using), and working their way through the
| dark pattern UI BS to get to the 'launch in browser' link
| to appear.
| CameronNemo wrote:
| There is an extension to go straight to the webjoin link.
| you can also just edit the link manually.
|
| https://addons.mozilla.org/en-US/firefox/addon/zoom-
| redirect...
|
| Check the screenshot. You just need to edit the "/j/"
| part of the path to "/wc/join/".
| dylan604 wrote:
| There are very few extensions that I trust, and to depend
| on an extension to do something as trivial as this is not
| worth the risk to me. This particular dark pattern isn't
| the darkest in the scheme of things.
| baxtr wrote:
| Great tip! I'll give a FF a try. Haven't used it in ages
| due to performance issues on Mac.
| dylan604 wrote:
| I read people's negative performance of FF comments, and
| I've just personally never experienced anything that
| makes me question if something is wrong. Then again, I
| don't use Chrome to do side-by-side comaprisons. I click
| a link, a page loads, I choose to read or not, and go on.
| That's pretty much all I expect my browser to do.
| galacticaactual wrote:
| Patrick Wardle seems to be getting a lot of press these days...
| scarface74 wrote:
| As a consultant, I have to use whatever video conferencing
| software that the customer uses. I refuse to install any of them
| on my work Mac and I use the web versions.
|
| The only video conferencing software I have installed is Chime
| [1].
|
| [1] yeah I know. How do you say where you work without saying
| where you work.
| gigatexal wrote:
| After the first thing with the zoom installer and their
| shenanigans on MacOS a while back I refused to install the app on
| my devices (except for mobile where I have no choice to use the
| app if I have to use zoom for something) and always use it via
| the browsers.
| joebob42 wrote:
| I've become a big Google meet shill. It works great, it's easy to
| get people onto it, quality is quite good. I've heard it can fall
| apart with really big groups of people, but never had any
| problems up to about 10, and beyond that I don't really care.
| userbinator wrote:
| _The result is a privilege escalation attack, which assumes an
| attacker has already gained initial access to the target system_
|
| Contrary opinion: I'd rather have a world in which everyone is
| always root on their machine and trusts all their software ---
| regardless of how mistaken that trust can be --- than the current
| trend of using "privilege separation" to take away freedom and
| control, create walled gardens, and silo applications from
| interoperating with each other. I have had little care for
| privilege escalation "attacks" ever since I realised that in
| practice they are so common, and also quite harmless (or
| sometimes even freedom- _enabling_ ), that it's often a way to
| feed the security-paranoia news machine and further drive users
| into the increasingly restrictive regimes of non-general-purpose
| computing.
|
| That said, I didn't install Zoom, but rather use a standard SIP
| client to join. As others have mentioned, using a browser is also
| possible when SIP is not an option.
| kortex wrote:
| We had that, it was called Windows 95 and you got viruses by
| merely connecting the computer to the net.
| jupp0r wrote:
| Why the hell does Zoom require root access to begin with? I used
| to work on a competitor and while it would have made some things
| easier we never found anything we wanted to do that was
| impossible without root permissions.
| teawrecks wrote:
| It's the easiest way to add convenient features without dealing
| with edge cases. Unfortunately, that also means convenient
| vulnerabilities.
| ilikepi wrote:
| The Zoom app itself doesn't need admin access. My primary non-
| admin account on my work Mac has it installed in
| ~/Applications, and I don't notice any missing functionality.
|
| The only annoyance is having to manually extract it out of the
| downloaded archive when I want to update it. But IIRC, this
| takes two commands, not including the commands to swap the new
| app bundle with the old.
|
| The downloaded archive is compressed with xar, and I believe
| that one should be extracted into an empty directory because
| otherwise it will spray files everywhere. Then the app bundle
| is in a gzipped cpio file...I think it's at Contents/Payload.
| tedmiston wrote:
| See previous HN posts about the Zoom installer.
|
| It does some unusual stuff that it probably doesn't actually
| need to be doing.
| jupp0r wrote:
| This says a lot about their engineering culture. There's no
| way I'd just casually take on the liability of having root
| privileges in the software I'm shipping to customers if it
| can be avoided. Them not caring is a huge red flag imho.
| nikanj wrote:
| Their engineering culture is very much "does it work",
| instead of "is it Correct".
|
| They have taken the market by storm, because most people
| care about the former, not the latter
| [deleted]
| galad87 wrote:
| Why does Zoom even need an installer for.
| ev1 wrote:
| To harass you into downloading by hiding the "open in browser"
| link when you click a zoom url.
| darkteflon wrote:
| PSA that you absolutely can attend Zoom calls from your Mac
| without installing this trashware. Firefox or Chrome is your
| friend.
| daniel-cussen wrote:
| This is what I did but it doesn't work all the way, break
| rooms don't work, broadcasts (Zoom theater) doesn't work,
| it's shitty. Like even in a VM it's shitty. Zoom no like VMs,
| Zoom yes like you installing it as root.
| neodypsis wrote:
| Can it tell it is being run inside a VM?
| More-nitors wrote:
| hm that's what some banking apps / most malware apps
| do...
| daniel-cussen wrote:
| No it can't tell--I'm sure they'd like to, the attitude
| is omniscience, infinite data for infinite perving
| looking for patterns. Like most patterns just aren't
| virtuous, like oh I can fuck them out of a few extra
| bucks if I bug them at 5 in the morning after a bad
| experience at small claims court. That's business
| intelligence. That's a pattern. Or another pattern, we
| get more signups after sending users "informative"
| messages terms of service have changed--it's actually a
| form of marketing, anything to nag and bug people with
| some minuscule link to the business and money that it
| craves for its tumescent growth aspirations. Otherwise it
| would be technological, like come up with actual useful
| knowledge that would actually be useful. Economists say
| in the long run all wealth and all progress comes down to
| technology. Technology is the only thing that matters.
|
| But yeah it can tell it's in a VM because that's when it
| decides to crap its pants. By this point it's impossible
| to tell if bugs are intentional when they benefit the
| startup, there's a whole game in bugs, like no don't fix
| it it causes the user to lose his shit and give up and
| pay for this upgrade in the hopes that it all gets
| better.
|
| There was one bug, yeah a bank bug I saw in Chile. So
| what this bug did is it fucked up printing the receipts
| after the user had paid and the bank machine said the
| transaction was approved. Employees would then insist the
| user hadn't paid because a receipt hadn't gone through.
| So the customer had to pay again--and the second time it
| always worked--double billing. Fucking stealing. Theft.
| MacDonald's at the SCL airport brazenly stole from me in
| exactly that way. And did that bug get fixed promptly?
| Ha...na let it be a little longer, it's not a high
| priority. It's...not urgent. Fix it next quarter, it's
| too difficult.
|
| You can't assume good faith in software as it's
| delivered.
| galad87 wrote:
| I mean that they could just ship the app on a disk image, and
| let the user drag it to /Applications or somewhere else.
| totetsu wrote:
| In the past I had audio desync issue with zoom on Firefox in
| Ubuntu
| csydas wrote:
| It's good to remind people, but Zoom does everything it can
| from my perspective to ensure no one is aware of this.
|
| By default if you click a Zoom meeting link to join, it takes
| you to the Zoom page and starts a download of the installer
| (.pkg for Mac). The "Join from Browser" option is hidden and
| if I remember right, you have to click "Join" again, and then
| it will show a small HTML link about Join from Browser.
|
| The Browser experience is subpar and buggy. A lot of features
| lag in the UI, it's very slow to connect to audio, and there
| are a few options I recall that reload the entire page
| without warning, meaning you leave the meeting and have to
| reconnect, often to find a double of yourself.
|
| I also noticed issues with USB Audio devices where after
| awhile, a static-ey robot noise would appear from you. No
| other voice apps I used experienced this, only Zoom and only
| with USB devices and from the browser version. Maybe it's
| something with Firefox + USB audio, but never was interested
| to investigate more.
|
| Zoom is really not good software and it's an exercise in
| frustration when we have to use it at work, and the pricing
| model seems a bit ridiculous, even for basic users.
| sofixa wrote:
| > Zoom is really not good software and it's an exercise in
| frustration when we have to use it at work
|
| Having used pretty much all video conferencing software,
| it's _by far_ the best in terms of features, UX, call
| quality, feature distribution across platforms (do you know
| that some like BlueJeans don 't allow you to have a
| separate audio input/output device if the device chosen for
| one supports both? (I have headphones and a separate mic, i
| can't have the headphones for output only). With Zoom as
| long as everyone is on the app and not the browser version,
| all features work. Teams on Linux or mac is always lagging
| months behind.
| jillesvangurp wrote:
| Zoom got lucky that they managed to build a brand name
| just around the time Covid hit and everybody discovered
| that they needed to do video calls suddenly. I don't
| think it's particularly well designed or has any
| particularly novel features. I've been doing online
| meetings for a very long time and Zoom is just yet
| another thing here. Very middle of the road in terms of
| design, UX, or what it does.
|
| In any case, I seem to need to talk to various companies
| using a disturbingly wide range of applications on a
| regular basis. Google Meets, Zoom, MS Teams, Cisco WebEx,
| Skype are all things I've used professionally in the
| recently. I've also used Slack, Discord, as well as
| Whatsapp, Facebook Messenger.
|
| The thing is, they all kind of work and roughly with
| similar audio/video quality and all with the same kind of
| performance, usability, and other issues. Some of these
| are more suitable for 1 on 1 meetings and some of these
| things seem to be geared towards corporate setups.
|
| I have a slight preference for using Google Meets; mainly
| because I can just launch that straight into the browser
| (Firefox) without any fuss and it just seems to work and
| is actually designed to work that way. There is no app
| even. You just click the thing in the calendar and it
| opens. Best of all, it plays nice with Firefox
| containers. So I can join corporate meetings with one
| account and private meetings with another. The most
| annoying thing is when you have 1 minute to join a
| meeting and you discover you need to first install some
| enterprise crap ware to join and then deal with
| permissions for it needing access to the screen, audio,
| etc. I just got a new laptop so, I got to do this a few
| times already in the last week.
| SoftTalker wrote:
| Zoom was eating the lunch of other online meeting
| software even before COVID. It was the only meeting
| software where you had a chance of getting started
| without spending the first part of the meeting doing
| impromptu tech support for people who could not see,
| hear, having to download some kind of browser plugin, or
| dealing with echos, etc.
|
| When the pandemic hit and everyone started working
| remotely, Zoom was already primed to be the winner.
| darkteflon wrote:
| There are loads of dark patterns, agreed. This drove me to
| go hunting in Firefox for a "don't automatically download
| shit" option, but to no avail. I guess they hijack your
| click from the previous page. Just all round awful.
|
| On the other hand, I've not had any audio or video problems
| once in the call, so ymmv.
| Aethylia wrote:
| You could change the option of where to save downloads.
| Instead of automatically putting them in the downloads
| folder, if you change it to ask every time, then you will
| get the file browser prompt before the download starts.
| _kbh_ wrote:
| A lot of macOS applications have a privileged helpers (these
| apps run as root and communicate with the main app) when you
| wouldn't think they would (teams for example).
|
| Most use them to update the application seamlessly without a
| pop up asking for permission from the users afaik.
|
| But yes it does mean you get hilarious stuff you wouldn't
| expect like privilege escalation to root in teams, zoom, etc.
___________________________________________________________________
(page generated 2022-08-13 23:01 UTC)