Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BlueJeans also runs a webserver when installed on macOS

support.bluejeans.com

Post reply on HN
Print view View original

61–70 of 98 posts

Re: BlueJeans also runs a webserver when installed on macOS

#61

Post by scarface74 »

chrisfinazzo wrote: post #56
scarface74 wrote: post #39

Earlier quoted context omitted.

And you are not forced to abide by the developer terms to release a program for the Mac just as I said. Despite all of the HN conspiracies, you can develop for and release code on the Mac without Apple’s permission. You don’t have to abide by those terms.

Wait a while. Holding one's breath not recommended. For those who don't want to (or cannot, due to the nature of their application) use the Mac App Store to distribute software, the requirements will only continue to get more specific until (to the extent possible) all executable code and resources are notarized and signed with an identity.

This same prediction has been going on since 10.6 - over 7 versions ago. How do you propose that Apple forces code signing on programs that run on top of a VM like the CLR or JVM? How do you propose they enforce it for programs run using a scripting language? The best they could do is force signing on the runtimes.

But my point still stands. Today on July 9th 2019 you are not forced to be part of the developer program to distribute apps on the Mac. Despite all of the pollyanish the sky is falling type that has been going on for over a decade.

Re: BlueJeans also runs a webserver when installed on macOS

#62

Post by dpkonofa »

AlexandrB wrote: post #51

I don't understand the rationale here: > Determine if the BlueJeans desktop application is already installed. This allows us to offer a new installation or launch the existing app based on the user's machine. If the "Detector" is installed, but the desktop app is not the user removed the BlueJeans app at some point because they didn't want it. How is silently installing it again against the user's prior wishes a reas…

I don't think that's the rationale behind this. If a user is clicking a link to start a BlueJeans session, then it's not against the user's prior wishes anymore. It's the user's current wish to start a BlueJeans meeting and that wish requires the BlueJeans app to continue. Without the "detector", the link click just fails and nothing happens. With the detector, it's determined that the app isn't installed and the user is prompted to install BlueJeans. Otherwise, the app is opened and the correct meeting is started/joined. Nothing is silently done here.

That being said, this is still a crappy way to do this. Installing a server is not the solution to this. Browsers need to do a better job of dealing with this and that would get rid of the root issue but, in the interim, these developers need to figure out a better way than installing web servers on everyone's machine. Otherwise, everyone's computer ends up with 10000 of these stupid little single-purpose applications that are always running.

Re: BlueJeans also runs a webserver when installed on macOS

#63

Post by vbezhenar »

ghostpepper wrote: post #13
vbezhenar wrote: post #9

Earlier quoted context omitted.

How is it trashing user security?

By running a web server with the ability to circumvent installation? It could almost be considered a backdoor

User willingly installs their software, they are not backdooring it. There are plenty of services running on every computer, including TCP servers and web servers. If you're going to call them backdoors, you've got a long list.

Re: BlueJeans also runs a webserver when installed on macOS

#64

Post by amluto »

josteink wrote: post #22
AgloeDreams wrote: post #7

Earlier quoted context omitted.

Wow that is really damning, trashing user security in trade to remove a single click that makes it clear as to what is happening. This totally breaks Apple's Developer Terms right?

> Wow that is really damning, trashing user security in trade to remove a single click As someone who has had to develop and maintain a similar web-to-desktop bridge I can tell you that this one issue was responsible for around 90% of my company’s total support requests, despite only being a small feature in a optional addon in one of our main products. For businesses just trying to keep their customers happy, this p…

And this is why the web browser vendors need to simply disallow this behavior. Websites seem to think they seem to engage in awful behavior to compete with each other. If the browsers just block it outright, then everyone will be on a level playing field.

Re: BlueJeans also runs a webserver when installed on macOS

#65

Post by scarface74 »

ceejayoz wrote: post #54
scarface74 wrote: post #39

Earlier quoted context omitted.

And you are not forced to abide by the developer terms to release a program for the Mac just as I said. Despite all of the HN conspiracies, you can develop for and release code on the Mac without Apple’s permission. You don’t have to abide by those terms.

The Zoom and BlueJeans apps are both signed, which indicates they're part of Apple's Developer Program, and thus bound by its terms. If you want to distribute an unsigned app and guide users into bypassing Gatekeeper for it, by all means, do so... but that's not what's happening in this case, nor is it particularly common due to the intentional hoops they make you (or more accurately, every single prospective user of…

And that still doesn’t contradict my statement that you can distribute apps for the Mac without being in the developer store....

Re: BlueJeans also runs a webserver when installed on macOS

#66

Post by scarface74 »

ceejayoz wrote: post #42
scarface74 wrote: post #38

Earlier quoted context omitted.

You don’t have to be in the developer program ftp distribute your app on the Mac .

Technically? No. It'll largely refuse to run ("App can't be opened because it is from an unidentified developer") if it's not signed via Gatekeeper, though. There's a procedure to bypass that, but it's hardly user-friendly. https://support.apple.com/kb/ph25088?locale=en_US

Yes control click is really complicated.

Re: BlueJeans also runs a webserver when installed on macOS

#67

Post by eridius »

LeoNatan25 wrote: post #58
eridius wrote: post #57

It looks like if you delete Blue Jeans.app and then restart (or log out), the webserver won't relaunch. It will attempt to run on load, but the actual script to start it invokes the app binary with a special argument, so deleting the app is sufficient. The "log out" part is because the webserver will presumably continue running in memory after deleting the app until you force it to quit. It's possible that it watches…

Yes, I’m the case of BlueJeans, the server sits inside the app bundle.

What's rather curious is it uses what appeared to be a nodejs server stored in ~/Library/Application Support/Blue Jeans/, but it passes the path to that to the app bundle (I can't inspect it further since I already deleted that whole folder). My best guess is Blue Jeans wanted the ability to update the server independently of the app, though I don't know why.

Re: BlueJeans also runs a webserver when installed on macOS

#68

Post by scarface74 »

monocasa wrote: post #41
scarface74 wrote: post #10

Earlier quoted context omitted.

There are no “developer terms” that developers have to abide by for the Mac.

If they're notarized there's around a hundred pages of terms and conditions you have to agree to. Although I'm not sure this gets in the way of any of them except on one of the blanket ones that Apple keeps intentionally vague.

Yes if 6 == 100.

A sibling reply posted the link.

https://developer.apple.com/terms/apple-developer-agreement/...

Re: BlueJeans also runs a webserver when installed on macOS

#69

Post by dpkonofa »

josteink wrote: post #44
tobr wrote: post #32

Earlier quoted context omitted.

That is interesting. What were the support requests, how to remove the confirm step, or what to do if you denied it but didn’t mean to? Or something else?

Most desktop-browsers have in the name of security made it exceptionally hard to accidentally launch external programs through this mechanism. We’re talking software engineering phd can’t complete it without hand-holding hard (true story!) So normal users definitely don’t understand nor manage to navigate the dialogs presented by the browser to produce a “successful” outcome. In the past we used this mechanism to “au…

I have to call BS on this. Are you claiming that users can't complete a single prompt of "[Your browser] needs to open an external application to follow this link. (Decline) (Launch Application)"? That seems really unlikely. I've done enough user testing to, at least anecdotally, say with some certainty that this is not true.

Re: BlueJeans also runs a webserver when installed on macOS

#70

Post by dpkonofa »

vbezhenar wrote: post #9
AgloeDreams wrote: post #7

Earlier quoted context omitted.

Wow that is really damning, trashing user security in trade to remove a single click that makes it clear as to what is happening. This totally breaks Apple's Developer Terms right?

How is it trashing user security?

Look at what just happened with Zoom. The web server could be used by a malicious third-party to gain access to the system.
Post reply on HN