BlueJeans also runs a webserver when installed on macOS • Hacker News Board

Re: BlueJeans also runs a webserver when installed on macOS

#41

Post by monocasa » Tue, Jul 09, 2019, 7:49 PM UTC

scarface74 wrote: post #10

AgloeDreams wrote: post #7

Earlier quoted context omitted.

Wow that is really damning, trashing user security in trade to remove a single click that makes it clear as to what is happening. This totally breaks Apple's Developer Terms right?

There are no “developer terms” that developers have to abide by for the Mac.

If they're notarized there's around a hundred pages of terms and conditions you have to agree to. Although I'm not sure this gets in the way of any of them except on one of the blanket ones that Apple keeps intentionally vague.

Re: BlueJeans also runs a webserver when installed on macOS

#42

Post by ceejayoz » Tue, Jul 09, 2019, 7:55 PM UTC

scarface74 wrote: post #38

ceejayoz wrote: post #27

Earlier quoted context omitted.

I'm fairly certain you have to agree to some to join the Apple Developer Program, which is (sort-of) required if you want people to be able to run your app.

You don’t have to be in the developer program ftp distribute your app on the Mac .

Technically? No.

It'll largely refuse to run ("App can't be opened because it is from an unidentified developer") if it's not signed via Gatekeeper, though.

There's a procedure to bypass that, but it's hardly user-friendly. https://support.apple.com/kb/ph25088?locale=en_US

Re: BlueJeans also runs a webserver when installed on macOS

#43

Post by syn0byte » Tue, Jul 09, 2019, 7:56 PM UTC

komali2 wrote: post #16

prophesi wrote: post #6

Earlier quoted context omitted.

They were probably also against Window's UAC popups.

Everyone I knew was against UAC popups, including security professionals. They were likened to California Prop 65 warnings: so prolific as to be ignored, and arguably causing more harm than good, because just as apparently since EVERYTHING causes cancer one can't make decisions about avoiding things that actually do, so to does EVERYTHING trigger a UAC popup and so who gives a fuck, one more thing to quickly ignore a…

It pops up with exactly as much frequency as a normal user account in most Posix-like systems would require "su" of one form or another. For exactly the same reasons. It's just expected behavior for those systems, but completely unacceptable for Windows.

And we wonder why Microsoft sucks so bad at securing Windows.

Re: BlueJeans also runs a webserver when installed on macOS

#44

Post by josteink » Tue, Jul 09, 2019, 7:59 PM UTC

tobr wrote: post #32

josteink wrote: post #22

Earlier quoted context omitted.

> Wow that is really damning, trashing user security in trade to remove a single click As someone who has had to develop and maintain a similar web-to-desktop bridge I can tell you that this one issue was responsible for around 90% of my company’s total support requests, despite only being a small feature in a optional addon in one of our main products. For businesses just trying to keep their customers happy, this p…

That is interesting. What were the support requests, how to remove the confirm step, or what to do if you denied it but didn’t mean to? Or something else?

Most desktop-browsers have in the name of security made it exceptionally hard to accidentally launch external programs through this mechanism.

We’re talking software engineering phd can’t complete it without hand-holding hard (true story!)

So normal users definitely don’t understand nor manage to navigate the dialogs presented by the browser to produce a “successful” outcome.

In the past we used this mechanism to “automatically” provide configuration-data a desktop component, so that it could call back to our application. And our users just didn’t manage to configure it.

In the name of security, browsers made one path so hard to use, without considering what people would then develop instead.

And here we are now. Oops!

Re: BlueJeans also runs a webserver when installed on macOS

#45

Post by volfied » Tue, Jul 09, 2019, 8:00 PM UTC

> However, this dialog is an annoyance to the user at best, and at worst may scare the user into denying a legitimate request.

It is a great security feature at best. It tells me that a website I visited is about to launch something on my computer. A website launching an app on my machine scares me more than any pop up.

Re: BlueJeans also runs a webserver when installed on macOS

#46

Post by zelon88 » Tue, Jul 09, 2019, 8:07 PM UTC

Typical "My functionality is the only thing that matters" pretentious mindset.

It's a general purpose personal computer. Not some device you sold me which exists for the purpose of solely connecting to your app.

Let's treat automobiles the same way you'd like us to treat computers. I go to a Shell station to fill up with gas. They have custom nozzles, and I have to drill a hole and weld on a special fitting to get gas. Two days later I go to BP and fill up again. They have proprietary nozzles that don't work with Shell fittings. So I drill another hole and weld on another fitting. 6 months and 40 gas stations later my car barely moves because it's a tragic mess of holes and ugly shit welded all over it. Why? Well I might want to stop at a Shell station in the future.

F* that and any company who operates this way.

Re: BlueJeans also runs a webserver when installed on macOS

#47

Post by prophesi » Tue, Jul 09, 2019, 8:10 PM UTC

komali2 wrote: post #16

prophesi wrote: post #6

Earlier quoted context omitted.

They were probably also against Window's UAC popups.

Everyone I knew was against UAC popups, including security professionals. They were likened to California Prop 65 warnings: so prolific as to be ignored, and arguably causing more harm than good, because just as apparently since EVERYTHING causes cancer one can't make decisions about avoiding things that actually do, so to does EVERYTHING trigger a UAC popup and so who gives a fuck, one more thing to quickly ignore a…

Yeah, that makes sense. And I can't think of any way to accomplish it better :/ Every app you install can potentially cause computer 'cancer'.

As a sister comment mentions, it's akin to warning the user whenever they run a command under su/sudo.

Re: BlueJeans also runs a webserver when installed on macOS

#48

Post by nickdandakis » Tue, Jul 09, 2019, 8:13 PM UTC

josteink wrote: post #22

AgloeDreams wrote: post #7

Earlier quoted context omitted.

Wow that is really damning, trashing user security in trade to remove a single click that makes it clear as to what is happening. This totally breaks Apple's Developer Terms right?

> Wow that is really damning, trashing user security in trade to remove a single click As someone who has had to develop and maintain a similar web-to-desktop bridge I can tell you that this one issue was responsible for around 90% of my company’s total support requests, despite only being a small feature in a optional addon in one of our main products. For businesses just trying to keep their customers happy, this p…

Did your company try to write an FAQ page on how to accept the double-confirm dialogs in all major browsers (with screenshots) to maybe reduce your "90% of support tickets"? Does your ticketing software redirect you to (or display) an FAQ page that matches the ticket title?

I've come to understand how features like these get built, but I've also come to understand that people that use software are a lot more resilient and savvy than we think.

If 90% of your support tickets are about getting through a standard double-confirm, patio11 would probably recommend increasing your pricing to limit your paying customers to a pool that probably won't have much more trouble with that.

Re: BlueJeans also runs a webserver when installed on macOS

#49

Post by wrs » Tue, Jul 09, 2019, 8:17 PM UTC

vomitcuddle wrote: post #17

Why is this news? A lot of desktop applications do this. The Spotify client used to do it to enable play/pause controls from any webpage. Dropbox also definitely used the same method for single sign on, maybe still does, I don't use it anymore.

I had a WiFi router that by default was set to filter out DNS responses with RFC1918 addresses. A surprising amount of stuff was broken until I figured that out.

Re: BlueJeans also runs a webserver when installed on macOS

#50

Post by kstrauser » Tue, Jul 09, 2019, 8:17 PM UTC

muzzio wrote: post #5

prophesi wrote: post #4

Have these video conferencing services never heard about External Protocol Requests in browsers? It's a much less hacky, and much more secure method to pull off this same feature-set.

Zoom responded to this point [1]: > This is a workaround to a change introduced in Safari 12 that requires a user to confirm that they want to start the Zoom client prior to joining every meeting. The local web server enables users to avoid this extra click before joining every meeting. We feel that this is a legitimate solution to a poor user experience problem, enabling our users to have faster, one-click-to-join m…

I resisted the urge to vote you down simply because their response you quoted pissed me off so much. I'm going to remind my CTO of this when our contract expires and it's time to evaluate alternatives.

Signed, Unamused CISO