Live data from Hacker News

Zoom rolled their own encryption scheme, transmit keys through servers in China

citizenlab.ca

291–300 of 316 posts

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#291
post #211

Earlier quoted context omitted.

At first, the site attracted about sixteen hundred daily visitors, and Graham moderated and maintained it himself. Today, around five million people read Hacker News each month, and it’s grown more difficult to moderate. The technical discussions remain varied and can be insightful. But social, cultural, and political conversations, which, despite the guidelines, have proliferated, tend to devolve. A recent comment t…

I find that the opposite is true. Most comments are emotional, and I have to search for controversial comments to find anything objective/worth reading. Like Reddit, this site is biased to the political left (USA). I wish we could just avoid all politics in tech.

I'm starting to increasingly appreciate comments like this, because they appear regularly on both sides of the ideological divide, helping me keep my binary tree fresh and balanced. A few that go the opposite way:

https://news.ycombinator.com/item?id=22706668

https://news.ycombinator.com/item?id=22705507

https://news.ycombinator.com/item?id=13110004

Sorry if that sounded snarky—I don't mean to pick on you personally, and I don't disbelieve you. But the perception is explicable by the notice-dislike bias: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que....

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#292
post #242
post #211

Earlier quoted context omitted.

I find that the opposite is true. Most comments are emotional, and I have to search for controversial comments to find anything objective/worth reading. Like Reddit, this site is biased to the political left (USA). I wish we could just avoid all politics in tech.

People are political animals. The only way to avoid politics is to avoid people. Not exactly a workable proposition if you want to change the world with a billion dollar unicorn.

I think that's true, but it's also true that the distinction between curious conversation and ideological battle is a useful and actionable one, and that's basically what the site guidelines are staked on: https://news.ycombinator.com/newsguidelines.html.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#293
post #136

Earlier quoted context omitted.

While you wait for his response: https://www.newyorker.com/news/letter-from-silicon-valley/th...

Fascinating, thanks for sharing. Makes me reflect on the (relatively few) comments I've made here, and if I'm making a positive impact on the community.

Oh come on. It's always the good users who worry about this.

(I looked at your comments and the ones I saw are not only fine, they're exactly what HN is for.)

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#294
post #136

Earlier quoted context omitted.

While you wait for his response: https://www.newyorker.com/news/letter-from-silicon-valley/th...

I wonder how that approach can continue to make sense unless they hire more Lisp moderators.

I don't understand your point but I relate to the idea of hiring more Lisp moderators.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#295
post #124

Matthew Green's article on this is has a thread here: https://news.ycombinator.com/item?id=22771193 The Intercept article on it has a thread here: https://news.ycombinator.com/item?id=22767807 It's probably too much of a stretch to merge all these, because many comments are about specifics of those posts, and the ones that aren't are kind of generic and so maybe not worth merging anyway ( https://hn.algolia.com/?date…

Hi dang, Thanks in advance for all your moderation efforts that make HN the site we all love to use on a regular basis. I'm curious if you've ever considered writing a blog post about some of the things you've learned from your years of moderation? You spend so much time on HN, you must have seen lots of patterns and have lots of insights on...well, everything that gets posted on HN to everybody that posts on HN. I'd…

I'm late to this thread because for some reason I only just noticed it. Thanks for the nice comment! It's fun to hear from someone who is just curious.

I do think of writing about HN, but not a blog post, because I can't think of a good reason. I don't enjoy writing (https://news.ycombinator.com/item?id=14431262), at least not that kind of thing. Somehow I maneuvered myself into a job that is basically being a writer...of that kind of thing. Writing because you enjoy it, or were born to do it, is the best reason; failing that, it could be a means to an end. But what end?

I do intend to write about HN in a different way. There are core moderation topics I've been posting about and returning to for years now (https://news.ycombinator.com/threads?id=dang). I'm inching my way towards distilling those comments into mini-essays, or discrete paragraphs, about the principles of HN: what kind of community we want HN to be and how to get there. I think there's an opportunity for a step change if we become more conscious as a group about what we're trying to be and why.

The "why" is critical because the rules here can seem a bit lame if you think of them only as constraints. Many creative minds are the sort that don't see why they should respect arbitrary constraints. For such people, the way to win them over is to derive the rules from first principles: to show how it's in their interest to follow them because that's the way we get to have, and keep, an interesting community over time. That's what I try to do in moderation comments, at least on good days: not to scold people, but to persuade them.

My intention is to distill all that commentary into a series of posts that can form sort of the case law, or midrash, or zoography, of the core topics around HN community. I don't know if anyone has noticed, but I already do that by linking back to previous moderation comments using specific keywords. Some examples:

https://hn.algolia.com/?sort=byDate&dateRange=all&type=comme...

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

There are at least a dozen of these. My idea is to consolidate that material into little essays that interpret, explain, and basically act as hermeneutics to the site guidelines. Then maybe, in the future, I won't have to type out a whole new comment on $topic; I can just link to the canonical explanation. In other words, I intend to write more in order to write less! Other than that, for learnings and patterns about moderating HN, your best bet is to lure me with the right kind of beer. Or just ask a question here.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#296
post #8

Zoom deserves a lot of animosity for its privacy issues like sharing data with Facebook. On the other hand I am mystified by all the security hype. Yes I might be able to guess a Zoom meeting ID, just as if I might guess your phone number and prank call you. In a Zoom meeting you can see who is connected . In the old days of conference calls do you remember asking “who’s on the line?”. What are you talking about that…

> What are you talking about that requires encryption? your health, your finances, your PII

>If so there are tools for that - signal, etc. a service that requires a phone number to not let you share your desktop screen with multiple people at once certainly isn't going to be the right tool.

> I am mystified by all the security hype

https://zoom.us/healthcare

they are selling a product at a markup for seats to a play at the local high school security theater.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#297
post #141

Earlier quoted context omitted.

I'm not going to play "guess what my username means" with you, sorry. I'm also not going to play "who knows more people that lived through the 3rd reich" with you. Me administering a Zoom account for my fellow employees and my students does not erode anybodies right. For me it is a choice between a GDPR compliant vendor and a vendor that does not care about the GDPR. Personally I have had good experiences with the GD…

> and Zoom claims to be GDPR compliant. That's the thing, though. Zoom also claimed to be end-to-end encrypting with AES-256. If they were willing to lie about that, what's not to say they're willing to lie about GDPR compliance?

Because one of those lies carries massive legal and financial penalties, and the other one doesn't?

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#298

The serverside key handling stuff is bad, but generally known (Zoom has features whose natural implementation require them to keep keys serverside). People are dunking on Zoom for rolling their own crypto and coming up with AES-128-ECB. This is also bad, but people should be aware that it's a lot more complicated than "you can see penguins through it". You can see penguins through an ECB-encrypted bitmap because disc…

> induce plaintext patterns, and use chosen boundaries to isolate targeted ciphertext

Like setting a custom, static background? One of zooms fun features.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#299
post #265

Earlier quoted context omitted.

>The site’s now characteristic tone of performative erudition—hyperrational, dispassionate, contrarian, authoritative—often masks a deeper recklessness. Ill-advised citations proliferate; thought experiments abound; humane arguments are dismissed as emotional or irrational. Logic, applied narrowly, is used to justify broad moral positions. The most admired arguments are made with data, but the origins, veracity, and…

Another reason IMHO that this site has maintained its relative quality is the policy of effectively banning memes (whether textual or visual) and not embedding images from links or allowing them to be attached. Someone needs to do a deep cognitive study of how memes, especially in image form, affect cognition during discourse. Whatever is going on it seems obvious that their presence immediately reverts people to a j…

When you mentioned borg songs, I internally cried because of the new Picard show. It broke the emotional core of TNG for a cheap thrill, and your mention of Borg songs reminded me of that.

Re: Zoom rolled their own encryption scheme, transmit keys through servers in China

#300
post #291
post #211

Earlier quoted context omitted.

I find that the opposite is true. Most comments are emotional, and I have to search for controversial comments to find anything objective/worth reading. Like Reddit, this site is biased to the political left (USA). I wish we could just avoid all politics in tech.

I'm starting to increasingly appreciate comments like this, because they appear regularly on both sides of the ideological divide, helping me keep my binary tree fresh and balanced. A few that go the opposite way: https://news.ycombinator.com/item?id=22706668 https://news.ycombinator.com/item?id=22705507 https://news.ycombinator.com/item?id=13110004 Sorry if that sounded snarky—I don't mean to pick on you personally,…

I think people often mistake bias in the moderation for bias in the moderators, ignoring that much moderation depends on flagging, which in turn is influenced by the bias of the people who were attracted to the conversation.
Post reply on HN