I'll pass on your zoom call

(operand.online)

84 points | by c4lliope 3 days ago ago

71 comments

  • raw_anon_1111 2 days ago

    So at one point Zoom surreptitiously installed a web server on the Mac causing a security vulnerability

    https://appleinsider.com/articles/19/07/10/apple-removes-zoo...

  • Neywiny 2 days ago

    You can run zoom in the browser. At least you could some years ago. Encryption is relevant depending on what you're doing but not everything needs to be super secret. A common practice is to email or use secure file shares while on the call to maintain that security.

    • neilv 2 days ago

      You can still. There's a small dark pattern to discourage it, though. You go to the URL for the call, click the button to launch the app, and when that fails, you see a small link to do the call in the Web browser.

      • chrismorgan 2 days ago

        https://addons.mozilla.org/en-GB/firefox/addon/zoom-redirect... handles the necessary skip. All it needs is to redirect /j/* to /wc//join (and /s/ to /wc/*/start).

      • jmathai 2 days ago

        Small? Gawd, I hate doing that for every single Zoom call I have to join.

      • IG_Semmelweiss 2 days ago

        every once in a while, someone will ask me to screenshare on a shared monitor, then i will have to explain i cannot , because i am on zoom browser.

        Its always great to see the reactions that gathers. Its a true rainbow: bemusement, curiosity, exasperation, outright suspicion...and everything in between!

        • digiown 2 days ago

          It works just fine? At least on Linux wayland it works in both firefox and chromium

      • QuantumNomad_ 2 days ago

        I already have Zoom installed on the work computer but for some reason it has started doing this weird thing where every time I click a Zoom meeting link in Google Calendar, Google Chrome downloads a copy of the Zoom installer at the same time as it opens the already installed Zoom. I didn’t notice until I already had six recently downloaded copies of the installer in the Downloads folder.

        No idea why this happens. But it’s probably part of the crappy pushiness of Zoom to get people to install their app that makes them trigger a download of the installer because either they are not detecting that Zoom is already installed at the right time, or they are so eager to download the installer that they don’t even care about whether or not you already have it installed.

        I’ve disliked Zoom since the beginning for their antics, and the only reason I have it installed is because I have to for the meetings at work, and the work computer belongs to the company I work for anyway, not to me.

        I would never install Zoom on my own computer.

        • frizlab 2 days ago

          Tangentially related, I think Safari detects duplicated downloads and only keep one

      • iammrpayments 2 days ago

        I had to do it once and is extremely difficult, I don’t remember the details but I think you have to do dozens of extra steps on your account configuration and it won’t work on your phone unless you request the desktop version of the website.

        • IG_Semmelweiss 2 days ago

          I'm used to it by now.

          Click on the meeting, where you will land on a download landpage. Then click the big download blue button in the center of the screen. WHen you click it a link will appear in the 2nd row below the blue button, something like "continue from browser", click on that, and you are golden

    • smoyer 2 days ago

      You can also install and run Zoom in FlatPak which secures your computer by running the executable in BubbleWrap. If you know what you're doing, you can also sandbox it directly.

  • valicord 2 days ago

    How much time did it take to write this rather than Google "join zoom in browser"?

    • lithocarpus 2 days ago

      Genuinely curious as I don't know - could zoom not still record what is said and use that for their own purposes?

      I just assume anything said near a computer could be and likely is recorded and stored by somebody, nowadays.

    • quietsegfault 2 days ago

      “Dial into zoom using telephone”

    • zparkes 2 days ago

      join zoom in browser only works if the host toggled that as an option.

  • normie3000 2 days ago

    > Jitsi - their biggest offense in my book is their name, which is hard to say is or is not really offensive.

    And who can't remember not using a video conference app that didn't have an inoffensive name?

    If "jitsi" is offensive, who to? If not, which video conferencing app names are?

    • aorth 2 days ago

      It comes from жици in Bulgarian, which means "wires".

      I think the author should remove that part of the blog post because it detracts from the author's point and is even a bit embarrassing that they hadn't looked it up.

      A reference for the name: https://desktop.jitsi.org/Documentation/FAQ.html#spelling

      • normie3000 2 days ago

        Thanks for the background. From the .si domain I'd assumed it was pronounced "Yitsi" not "Ðitsi".

    • titanomachy 2 days ago

      Sounds kind of like “Gypsy”, I guess.

      • fulafel 2 days ago

        Sounds far fetched. There's still the t vs p when pronounced by english speakers which are pretty distinct.

        WP on the name origin:

        > Jitsi (from Bulgarian: жици, "wires")

      • TurdF3rguson 2 days ago

        I'm 3/4 Gypsy and I don't have a problem with it.

        • nurettin 2 days ago

          They should add this to the docs as a quote.

  • mkmk 2 days ago

    Reminds me of the saying "Pessimists are often right. Optimists are often rich."

    • pmg101 2 days ago

      As a pessimist who's often right, and not rich, this resonates.

      But how can this be true? Surely you get rich by being right?

      • xboxnolifes 2 days ago

        Pessimists think nothing is worth doing, and are frequently right. But they will never catch the occasional thing that is worth doing. Some of the optimists will.

      • Valodim 2 days ago

        But optimism favors action, while pessimism favors inaction. And action vastly (and compoundingly) increases the amount of opportunities for being right.

      • sublinear 2 days ago

        Pessimists are just as often wrong too! Clearly the person you're replying to is an "optimist". :)

        To be clear, I don't think there's a strong correlation between being rich and being a pessimist/optimist.

        And to your original point, being right cannot possibly be biased towards optimism or pessimism. Any apparent correlation is more of a reflection on what everyone else thinks... and they are wrong! Cheers to being right!

        • dasil003 2 days ago

          Agreed, optimism/pessimism is just about our disposition to the world as we perceive it (ie. glass half full or half empty). It is orthogonal to understanding and prediction. A perfect Buddhist is neither an optimist or pessimist but can still be better or worse at predicting the future.

          I do think pessimists, especially of the depressive variety generally do not get rich. The reason is that getting rich is hard, everyone nominally wants it, so it’s highly competitive and there are no easy paths. To find a path generally you have to take an action that almost by definition is low probability of success. You don’t have to be a beaming cheerleader to make this happen, but being an eyore is most likely disqualifying.

        • tonyedgecombe 2 days ago

          I remember reading that slightly depressed people tend to have a more accurate world view.

          Perhaps there is something to the saying ignorance is bliss.

          • sublinear 2 days ago

            I might be misunderstanding, but I wouldn't call "un-depressed" people ignorant.

            I also think depressed people would regress to the average if they weren't depressed. It's not a sustainable way to think harder and open your eyes to the world around you.

          • pmg101 21 hours ago

            Yes I remember reading that too and it resonated. As a slightly depressed person I can't believe the delusionally positive spin people seem to put on everything and nonetheless this seems to be a winning strategy for them. I never could explain that.

            Starting with an accurate world model, no matter how dispiriting, seems to be a prerequisite for knowing the most effective action to take.

  • smoyer 2 days ago

    When Zoom took the world by storm due to the pandemic, they're security was known to be horrible. They aquihired the keybase team who are crypto experts and this presumably had some measure of positive effect.

    • SoftTalker 2 days ago

      The advantage of Zoom was that it just worked. No more spending the first 10 minutes of a call making sure everyone is online and can see/hear you. Or at least greatly improved.

      • prmoustache 2 days ago

        Most of the issues people had was authorizing their webcam/microhpone on their browser, it was no different/better with Zoom than any other service.

        And other services also had their own easy to install app (I think Jitsi only dropped the desktop app fairly recently).

        I think the only thing really easier with Zoom was remembering the name. I think the brand constitutes 99% of its success.

  • comfrey11 2 days ago

    Do you recall back in the day when zoom used to Root kit your computer?

    • yunnpp 2 days ago

      Yeah, that line, "people say Zoom is secure", instantly reminded me of how they opened a port on localhost that any website could connect to to run admin shit on the system. So I wonder, who says it's secure?

      Never mind the government surveillance.

    • jamesy0ung 2 days ago

      Yeah I have to use Zoom for work, but I wrote a little script that installs it without the background services and privileged helper tools

      https://raw.githubusercontent.com/jamesy0ung/zoom_grabber/re...

    • SanjayMehta 2 days ago

      I found a zoom daemon running on my kid's MacBook a year after uninstalling it. Turns out uninstall didn't kill background processes, needed a reboot to flush it away.

      • Izkata 2 days ago

        I swear I remember this being called a feature, they left something around after uninstall so that if you clicked a Zoom link it could reinstall the client seamlessly. An ease-of-use thing for less technical people.

      • asimovDev 2 days ago

        i am more impressed that the MacBook had a year uptime. The kid never rebooted it?

        • SanjayMehta a day ago

          Kiddo didn't care to reboot it, just closed the lid when the schoolwork was done.

          Most of our home machines (Intel) are never rebooted, still on High Sierra or Catalina.

  • ghgr 2 days ago

    > If there's one that I really need to be on, I'm going to spin up a VM on my computer so that it has no idea of the other files laying around, such as my ~/passcodes.csv. If you are such a negligent bullhead as to get me onto your call, you'll be unable to see me because my VM cannot access my camera! By design! Same for my microphone, so I'll plug in a USB mic if I really need to speak up. More likely than not though, I'm exhausted by now. I'll spend the full duration of the call eeking a small echo of pleasure from the continuation of this rambling alarm, for your sheepish audience to rub their enablist shame in.

    This is written in an edgy tone but it's pretty much SOP with QubesOS. Why would you install _anything_ in your main VM? Not just Zoom, but anything you import in a deep dependency graph can access your figurative ~/passcodes.csv anyway.

    • blitzar 2 days ago

      furthermore why would you give ~/passcodes.csv access to ~/nuke_launch_codes.csv and ~/incriminating_evidence.csv let alone connect the computer they are on to the internet

  • Wowfunhappy 2 days ago

    > If there's one [zoom call] I really need to be on, I'm going to spin up a VM on my computer so that it has no idea of the other files laying around, such as my ~/passcodes.csv`

    Oh come now. You don't really think Zoom is exfiltrating unrelated files from your computer, do you? If they got caught doing this, it would be such a major scandal... why risk it? And even though the client is closed-source I do think they'd get caught. It just isn't fathomable to me.

    • yjftsjthsd-h 2 days ago

      There's also security vulnerabilities. A while back there was a Firefox bug that let websites upload arbitrary files, which got used to steal SSH keys.

    • sciencejerk 2 days ago

      They wouldn't do it "intentionally". It would be an mistake "accidentally" made by a Developer or AI, that under the right conditions allows Zoom employees, etc arbitrary file reads on the host...

    • antonvs 2 days ago

      For the average user, you're probably right. In more secure environments, relying on the rational behavior of outside parties for your security isn't tenable.

    • mat0 2 days ago

      Or just open the call in the browser. It’s much easier to do that than to spin a vm. At this point I just distrust the author

    • relaxing 2 days ago

      They’ll claim the information was needed to protect the public from you, announce you’re the wrong sort of person and leak details about you to prove it, and a certain subset of hn commenters will show up to post about how the country is better for it (and it’s your fault for not using technology X to prevent the exfil.)

  • yladiz 2 days ago

    Serious question: is there a good, native/desktop alternative to Zoom for a professional setting besides Teams? As much as I don't trust Zoom, a huge advantage is that it's not stuck to your browser tab, so when you're doing basic things like presenting you can actually see the other participants in the call easily (this is a huge issue I have with Google Meet, if you don't use Chrome it is honestly a fairly bad experience because it doesn't try to support picture-in-picture in other browsers, and its screen sharing UX as a participant is borderline terrible because of the way it dynamically resizes the sharing in some cases).

  • neilv 2 days ago

    If you have to take the call, and your main concern is desktop client malware...

    At a startup a few years ago, since I was the engineering dept., I had to be on a lot of enterprise sales/partnership calls, and much of the time we had to use the other company's favorite videoconferencing software.

    Rather than installing those dumpster fire desktop apps on my Linux laptop that had the keys to our kingdom, I expensed an iPad that would be dedicated to random videoconf apps.

    We still get violated numerous ways, but at least compartmentalized from the engineering laptop.

    (I also used the iPad for passive monitoring of production at night, like a little digital photo frame in my living room, after putting away the work laptop.)

  • foresto 2 days ago

    MatrixRTC (aka Element Call) looks promising. I hope it develops into something nice.

  • fydgdbfn 2 days ago

    it sounds like you don’t wanna talk to anybody, and nobody wants to talk to you.

    • worthless-trash 2 days ago

      Wouldn't that be nice.. people not talking to me in real life..

  • satisfice 2 days ago

    I like Zoom. I have relied on it since 2020. I have Zoom calls almost every day. How long until I experience some sort of problem? Some time within the NEXT six years?

  • vee-kay 2 days ago

    Zoom is founded by a Chinese origin guy.

    Its security issues are already discussed earlier elsewhere, such as in this Reddit thread.

    https://www.reddit.com/r/privacy/comments/18d1bgi/is_zoom_st...

    [In the past is that Zoom said they were HIPAA Compliant, eg. had end-to-end encryption, and weren't. This was a huge issue at the beginning of the Pandemic when everybody started using them. This has since been fixed, but this wasn't their only lie or breach of trust.

    A few years ago, Zoom tried to insert a clause in their ToS that would have allowed them to use audio, video or chat content for training AI. But due to a LOT of backlash they backpedalled on that and now they "just" use telemetry data, product-usage data, diagnostic data and similar data “that Zoom collects or generates in connection with your or your End Users’ use of the Services or Software”.

    Zoom has had multiple instances of extremely sketchy behavior, including: * Deploying a rootkit on Macs to allow silent reinstallation of Zoom after removal. * Having vulnerabilities in said rootkit that took months to patch after trying to ghost the researcher. * Using useless encryption. * Lying about end-to-end encryption (they weren't even zero knowledge!) * Routing entirely US calls through China. * Lacking any reasonable access control to stop bombers.

    They have been caught lying-- not corporate speaking, not fudging a bit, outright lying-- on multiple occasions and had to replace parts of their leadership structure to try to fix the bad PR around it.]

  • sublinear 2 days ago

    Do people really still use Zoom in 2026?

    I hate Teams, but it's so common now that I can't remember the last time I ever took a call that wasn't on it. If I had to take one from another platform I'd assume it was sketchy!

    • vee-kay 2 days ago

      Teams is needed if there are going to be lots of participants in the online videoconference (which was the only metric where Zoom trumped all rivals, especially during the pandemic lockdowns (when Zoom was the only videoconf app that worked for online classes or office meetings that could support lots (100+) participants), but its rivals quickly learnt to fix their issues and scale up, so they are good now.)

      Otherwise Google Meet or WhatsApp are more than sufficient. They can support up to 20 participants with ease, based on my experience.

      For bigger conferences, Microsoft Teams is the way to go. All it needs is the host to have an Office 365 subscription, then others can join on the browser or app with no restrictions.

      Microsoft Teams offers a free version that allows users to chat, meet, and collaborate with others, although it has some limitations compared to the paid versions. The free version includes features like group calls for up to 60 minutes and 100 participants, along with 5 GB of cloud storage per user. Teams will warn in advance before the 60mins is up, so the host can simply end the Teams meeting session and start it again to get another 60mins of meeting time where everyone else can join in again.

      No need for Zoom and its security issues.

  • bravetraveler 2 days ago

    s/zoom //

  • 3 days ago
    [deleted]
  • dangus 2 days ago

    I mean, sure, fine, but nobody cares that some rando on the Internet doesn't agree to the ToS of Zoom. The article has no actionable information, is not interesting, and is beating an old subject to death.

    When I get on conference calls on business software that is primarily sold to and intended for businesses, I'm not usually doing so with the assumption of privacy. I'm usually doing so in the context of the semi-public activity I do at work.

  • bibelo 2 days ago

    Post author must be fun at parties

  • Imustaskforhelp 2 days ago

    I really love use fairmeeting.net as my jitsi goto server for any quick drawing board sessions or screensharing/video calling zoom alternative.

    I have used it for more over than 1 year/6 months with my friend where we both used and we used to very consistently think of how this service is free and how great it is etc.

    Thanks to fairmeeting.net ngl! One of the best services period. I wanted something in browser without too much hassle and something with a perma-link so I can join from different devices (I only had a pc back then and so I used to join with a kiosk tablet which only had browser & do other shenanigans)

    I found element calls to be interesting too but still personally I prefer fairmeeting.net! It's really stable when we used it for so many hours for so many days.

    I should probably donate to fairmeeting.net ^^

    If someone from the fairmeeting.net team is listening, I don't mind donating 10$ or such (yes a little broke haha!) to fairmeting if crypto option can be supported in the official website

    I do feel like there were some very minor features behind a donation paywall but honestly for 99.9% people its okay and what me and my friend used to do was use it with tldraw and make drawing boards and send messages with discord (I really wanted him to use matrix/we sometimes used signal) + fairmeeting.net + tldraw (before it required a sign in to create multiple pages, man that feature was so great for anonymous users)

    Anyways, I spent an hour or two trying to build a claude script which can make jitsi servers easier to deploy by using cloudflare api+dns feature & podman

    it's running on meet.fossbox.cloud enjoy everybody! (Please don't abuse it haha, sharing it in the same spirit as fairmeeting!)

    The script is Claude generated and under unlicense. Pasting both gist(github) and opengist(my server) links:

    https://opengist.fossbox.cloud/Admin/db747020aae14503b23e5a4...

    https://gist.github.com/SerJaimeLannister/d9f1511854b4dc5b17...

    > You can run zoom in the browser. At least you could some years ago. Encryption is relevant depending on what you're doing but not everything needs to be super secret. A common practice is to email or use secure file shares while on the call to maintain that security.

    Edit: Just wanted the last sentence to show Jitsi instance at https://meet.fossbox.cloud

    I kind of decided that I can help create an instance too instead of donating right away as my server runs <10$ (currently 8$ for 3 months 3 TB bandwidth everyday and afterwards a 100mbps cap plus more decentralization)

    Although I might shut down the server if I would need to utilize the resources though so if I ever do that, sorry about that!

    Alright time to sleep :> Good night!

    Edit: the server's xmpp isn't working, gonna try to get a fix of it before I sleep! (seems like I had proxy true and it had to be proxy false)

    Edit2: looks like its a bigger issue, I am gonna have to fix it later. Personally I don't know but I just like the workflow of using cloudflare api for dns management & building on it and I have built some other internal tools for myself for making ease of development so currently its gonna have an issue of self issued certificate which I will have to fix later most likely

  • SanjayMehta 2 days ago

    We decline all US based video calls. Use our Zoho Meet or get lost.

  • JSR_FDED 2 days ago

    If you’re joining a zoom call but don’t enable the camera and only maybe plug in a usb mic - just don’t join?