Introducing Keybase Chat • Hacker News Board

Re: Introducing Keybase Chat

#121

Post by cgijoe » Thu, Feb 09, 2017, 3:39 AM UTC

Warning to all OS X users: The Keybase Chat desktop app does a number of shady things that ultimately led me to delete it from my system. I am writing this purely as a public service announcement, to those who worry about installing unknown apps on their Macs. The Keybase Chat app:

(1) Requires administrator privileges to launch on first run, to install a "Helper Tool". The app does not explain what this tool does, where it lives, nor does the Keybase website.

(2) Installs a login (startup) item without asking permission, so Keybase will auto-launch on every boot.

(3) Installs a Finder Favorite in your Finder sidebar, without asking permission.

(4) Installs /usr/local/bin/keybase without asking permission.

(5) Installs /Library/PrivilegedHelperTools/keybase.Helper without asking permission.

(6) Installs /Library/LaunchDaemons/keybase.Helper.plist without asking permission.

(7) Installs ~/Library/LaunchAgents/keybase.* (3 files) without asking permission.

(8) Runs permanently in your menu bar, even if you quit the main app.

These things may all have good reasons and be benign, but they are too shady for me, so I deleted the app and all the files listed above. Apologies to the devs.

Re: Introducing Keybase Chat

#122

Post by hack4jesus » Thu, Feb 09, 2017, 3:54 AM UTC

cgijoe wrote: post #121

Warning to all OS X users: The Keybase Chat desktop app does a number of shady things that ultimately led me to delete it from my system. I am writing this purely as a public service announcement, to those who worry about installing unknown apps on their Macs. The Keybase Chat app: (1) Requires administrator privileges to launch on first run, to install a "Helper Tool". The app does not explain what this tool does, w…

i happen to know that the main developer is russian

Re: Introducing Keybase Chat

#123

Post by lewisl9029 » Thu, Feb 09, 2017, 4:14 AM UTC

This looks absolutely amazing!

Any plans for a web client for chat?

Re: Introducing Keybase Chat

#124

Post by rw » Thu, Feb 09, 2017, 4:26 AM UTC

cgijoe wrote: post #121

Warning to all OS X users: The Keybase Chat desktop app does a number of shady things that ultimately led me to delete it from my system. I am writing this purely as a public service announcement, to those who worry about installing unknown apps on their Macs. The Keybase Chat app: (1) Requires administrator privileges to launch on first run, to install a "Helper Tool". The app does not explain what this tool does, w…

How did you find these changes?

Re: Introducing Keybase Chat

#125

Post by arm » Thu, Feb 09, 2017, 4:34 AM UTC

rw wrote: post #124

cgijoe wrote: post #121

Warning to all OS X users: The Keybase Chat desktop app does a number of shady things that ultimately led me to delete it from my system. I am writing this purely as a public service announcement, to those who worry about installing unknown apps on their Macs. The Keybase Chat app: (1) Requires administrator privileges to launch on first run, to install a "Helper Tool". The app does not explain what this tool does, w…

How did you find these changes?

Not the parent, but it’s pretty easy to find all files on disk with a particular name with something like Find Any File¹.

――――――

¹ — http://apps.tempel.org/FindAnyFile/

Re: Introducing Keybase Chat

#126

Post by mark242 » Thu, Feb 09, 2017, 4:44 AM UTC

cgijoe wrote: post #121

Warning to all OS X users: The Keybase Chat desktop app does a number of shady things that ultimately led me to delete it from my system. I am writing this purely as a public service announcement, to those who worry about installing unknown apps on their Macs. The Keybase Chat app: (1) Requires administrator privileges to launch on first run, to install a "Helper Tool". The app does not explain what this tool does, w…

To play devil's advocate, steps 1, 2, 4, 5, and 6 are all fairly standard behavior for a Mac app that is installed "for all users on this system".

https://developer.apple.com/library/content/samplecode/SMJob...

Step 2 and 7 are fairly standard behavior for an application that is meant to be running at all times, eg a persistent chat app. Even something like GPG installs files into /Library/LaunchAgents. The location of the directories in question shouldn't set off a warning flag about whether an app is "shady" or not.

Re: Introducing Keybase Chat

#127

Post by cgijoe » Thu, Feb 09, 2017, 4:45 AM UTC

rw wrote: post #124

cgijoe wrote: post #121

Warning to all OS X users: The Keybase Chat desktop app does a number of shady things that ultimately led me to delete it from my system. I am writing this purely as a public service announcement, to those who worry about installing unknown apps on their Macs. The Keybase Chat app: (1) Requires administrator privileges to launch on first run, to install a "Helper Tool". The app does not explain what this tool does, w…

How did you find these changes?

I used the Unix "locate" command-line tool. I just searched for "keybase". Note that you have to build up a locate DB first by calling "sudo /usr/libexec/locate.updatedb". Type "man locate" in Terminal to learn more.

Re: Introducing Keybase Chat

#128

Post by CMay » Thu, Feb 09, 2017, 4:49 AM UTC

malgorithms wrote: post #2

OP here! I had to trim the post down for brevity, but I thought the HN community in particular might be interested in the API side of things. Undocumented in the post: you can invent channels for app-to-app communication from the JSON API. For example, it's possible with Keybase chat to have a program posting encrypted messages for another person or program, without cluttering up the visual chat interface. Also - to…

One thing I've noticed so far is that with the Keybase desktop client on Windows 10, the "Reddit Form" button for submitting a proof didn't work for me. It just fails silently and doesn't open a browser window or whatever it's supposed to do.

Additionally I am curious why on Reddit people have to post a wall of text, while on Twitter you only have to post a small tweet? Is there some reason people can't just paste the tweet version onto Reddit too?

Re: Introducing Keybase Chat

#129

Post by cgijoe » Thu, Feb 09, 2017, 4:49 AM UTC

mark242 wrote: post #126

cgijoe wrote: post #121

Warning to all OS X users: The Keybase Chat desktop app does a number of shady things that ultimately led me to delete it from my system. I am writing this purely as a public service announcement, to those who worry about installing unknown apps on their Macs. The Keybase Chat app: (1) Requires administrator privileges to launch on first run, to install a "Helper Tool". The app does not explain what this tool does, w…

To play devil's advocate, steps 1, 2, 4, 5, and 6 are all fairly standard behavior for a Mac app that is installed "for all users on this system". https://developer.apple.com/library/content/samplecode/SMJob... Step 2 and 7 are fairly standard behavior for an application that is meant to be running at all times, eg a persistent chat app. Even something like GPG installs files into /Library/LaunchAgents. The location…

I accept your devil's advocacy, but I would argue that the app should have simply asked permission before doing these things, especially installing itself as a startup item and adding a Finder favorite. Also, if the app is going to install things as an administrator, it should tell the user exactly what it plans to do. Just my $0.02. I know that Keybase the company is not shady, but their chat app sure feels off to me.

Re: Introducing Keybase Chat

#130

Post by kristianp » Thu, Feb 09, 2017, 5:22 AM UTC

Why does the page have 112px of top padding? Seems like a waste of space.

   body {
       overflow-x: hidden;
       padding: 112px 0 50px;
   }