71–80 of 264 posts
MS Teams is the worst software I've ever used. This is not hyperbole. A room full of monkeys on a typewriter would never create something as bad as teams.
At least the audio is consistently good, though.
A private discourse forum (actually any forum software, sometimes spam bots post gifs for usercounting!) does this to great effect with media too - it just allows embedding everything it seems. And then there is a university rocket-chat instance - with a big general-channel: And link-previews (enabled by default) somehow don't cache the images serverside, but let every client get them, because that's probably what works easiest with k8s, because who has a harddisk.
Earlier quoted context omitted.
So you are blaming Zoom security issues coverage on Microsoft without any proof and the comment asking for evidence is flagged. What's going on HN ?
This is a plausible scenario, definitely worth considering especially given Microsoft's track record.
Another plausible explanation, at least in my humble opinion, but one without evidence either: Everybody and their kids (for school) were using some kind of video conferencing software for the first time in this kind of professional/educational setting and Zoom led the pack, which led to more interest by white hat researchers (and probably blackhats) as well as journalists. This newfound scrutiny lead to some first stories, and then people kept digging, because "Man exposes himself in virtual class room"[0] or "Does China spy on your business" or "New security problem uncovered. Is your kid safe in the virtual class room?" kind of stories generate a lot of impressions, and zoom had a lot of problems to uncover. Maybe it took some time to uncover the various problems, leading to a continuous stream of stories, maybe some outlets delayed publishing some stories, so they could milk a story at a time before coming out with the next one. Maybe Microsoft tried to capitalize on it, but that doesn't mean they were driving the news.
[0] https://www.bbc.com/news/uk-england-south-yorkshire-55998557
Earlier quoted context omitted.
Even a very large amount of data pasted should not blow up a text box in 2021. I mean, on Windows you can paste an object referring to a data blob pretty sure, macOS surely has something similar and on X/Wayland you could sniff and size of data pasted in advance and do something useful. If it's plain text like JSON even 5G of plain text should not bring a text box to its knees when the memory is available, it's not b…
> still getting irritated by Firefox taking forever to render a 10M email source code in plain text when it could do something smart and render/view only the viewport that's showing. How do you know what's supposed to be in the viewport, especially if the font isn't monospaced? You have to 'render' the entire thing at least once - at least to the point of measuring the dimensions of text (not a cheap thing) and figur…
> We reported the issues to Microsoft in March 2021, who has only remediated one so far I feel that I read something like this almost every single time Microsoft is mentioned in a vulnerability disclosure. What makes the company so bad at dealing with security reports? I don't expect it to be a lack of talents or resources, or is it?
MS Teams is the worst software I've ever used. This is not hyperbole. A room full of monkeys on a typewriter would never create something as bad as teams.
One day they just completely fucked the ability to paste code. It worked flawlessly before and then suddenly it removes indenting, bugs out and doesn't let you exit the preformatted code block. It's so bugged, it's like they didn't even test it. They couldn't have, one day it literally worked fine and the next it was unusable and could be replicated every single time. And why there isn't the ability to just delete th…
The IP adress leak is also very common in a lot of "flashy" opensource projects trying to "solve" communications. Because apparently everyone wants his computer to visit a url to parse some data, so that one can decide whether the link is safe to click or not... A private discourse forum (actually any forum software, sometimes spam bots post gifs for usercounting!) does this to great effect with media too - it just a…
Of course there are concerns, especially on mobile where you may be able to do some location tracking.
Really the biggest place where IP leaking is a problem is gaming communities where people like to hammer IP addresses yo DoS people.
After tracing the HTTP requests received from the link-preview generation on the server (logging the network packets) I found that the "Host" header wasn't the expected/configured xn--test--ova.de (IDNA to ASCII).
To "work around it" I needed to add an extra VHost in Nginx with the server_name "test-\xFC.de" (that just redirected to a non-Umlaut domain).
I didn't bother or even know where to report it (to MS). But apparently not using proper tooling for URL handling / HTTP requests makes one wonder about the quality of the product or even possible security implications.
Earlier quoted context omitted.
> a rash of anti-zoom propaganda that I'm almost certain was driven by Microsoft Zoom had and continues to have a significant developer presence in China. Those individuals are subject to CCP coercion. There was also a time when they routed American calls through the mainland [1]. That has been fixed. But it remains excessive to cast all past criticism of Zoom as Microsoft's work. [1] https://techcrunch.com/2020/04/0…
Don't forget the directory traversal vulnerability too!