Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BlueJeans also runs a webserver when installed on macOS

support.bluejeans.com

Post reply on HN
Print view View original

71–80 of 98 posts

Re: BlueJeans also runs a webserver when installed on macOS

#71

Post by dpkonofa »

josteink wrote: post #14
prophesi wrote: post #4

Have these video conferencing services never heard about External Protocol Requests in browsers? It's a much less hacky, and much more secure method to pull off this same feature-set.

> Have these video conferencing services never heard about External Protocol Requests in browsers? Have you tried using them? Then you would know they don’t do that for a good reason. I answered a similar question in the zoom thread: https://news.ycombinator.com/item?id=20389310

This answer and your other answer are basically non-answers. You haven't listed any specific reasons why using them is difficult. Unless you have a specific scenario that applies to enough people, EPRs are the best way to handle this currently in a way that gives the users control over what happens. You shouldn't need to work around these controls.

Re: BlueJeans also runs a webserver when installed on macOS

#72

Post by monocasa »

scarface74 wrote: post #68
monocasa wrote: post #41

Earlier quoted context omitted.

If they're notarized there's around a hundred pages of terms and conditions you have to agree to. Although I'm not sure this gets in the way of any of them except on one of the blanket ones that Apple keeps intentionally vague.

Yes if 6 == 100. A sibling reply posted the link. https://developer.apple.com/terms/apple-developer-agreement/...

Can you expand? I'm not sure what your comment means.

Re: BlueJeans also runs a webserver when installed on macOS

#73

Post by munchbunny »

syn0byte wrote: post #43
komali2 wrote: post #16

Earlier quoted context omitted.

Everyone I knew was against UAC popups, including security professionals. They were likened to California Prop 65 warnings: so prolific as to be ignored, and arguably causing more harm than good, because just as apparently since EVERYTHING causes cancer one can't make decisions about avoiding things that actually do, so to does EVERYTHING trigger a UAC popup and so who gives a fuck, one more thing to quickly ignore a…

It pops up with exactly as much frequency as a normal user account in most Posix-like systems would require "su" of one form or another. For exactly the same reasons. It's just expected behavior for those systems, but completely unacceptable for Windows. And we wonder why Microsoft sucks so bad at securing Windows.

It was the collision of Microsoft trying to limit "run as admin" and Windows developers taking users running as admin for granted for too long. There had to be a period of pain as "if it ain't broken don't fix it" developers got around to not asking for unnecessary permissions.

These days you mostly see the prompt when you're installing or updating an app, which makes a lot of sense.

What I mean is, this is Microsoft's fault so far as users got in the habit of running in admin in the first place, but I doubt you would've been able to do better given where Microsoft was with its software ecosystem going into Vista.

Re: BlueJeans also runs a webserver when installed on macOS

#74

Post by josteink »

dpkonofa wrote: post #69
josteink wrote: post #44

Earlier quoted context omitted.

Most desktop-browsers have in the name of security made it exceptionally hard to accidentally launch external programs through this mechanism. We’re talking software engineering phd can’t complete it without hand-holding hard (true story!) So normal users definitely don’t understand nor manage to navigate the dialogs presented by the browser to produce a “successful” outcome. In the past we used this mechanism to “au…

I have to call BS on this. Are you claiming that users can't complete a single prompt of "[Your browser] needs to open an external application to follow this link. (Decline) (Launch Application)"? That seems really unlikely. I've done enough user testing to, at least anecdotally, say with some certainty that this is not true.

It’s a two-dialog process (allow website to use external protocol & what external program should be used for this protocol), with intentionally confusing wording making it easy to choose the wrong choice (disallow) if you don’t read thoroughly.

Unless you already know what to do it’s fairly unintuitive.

Most users don’t even know the difference between a single click and a double click.

Expecting them to even know what an external protocol is, or why it should be launched at all is completely unreasonable.

Re: BlueJeans also runs a webserver when installed on macOS

#75

Post by scarface74 »

monocasa wrote: post #72
scarface74 wrote: post #68

Earlier quoted context omitted.

Yes if 6 == 100. A sibling reply posted the link. https://developer.apple.com/terms/apple-developer-agreement/...

Can you expand? I'm not sure what your comment means.

You said there are “about 100 pages of terms and conditions you have to agree to”. There are six pages.

Re: BlueJeans also runs a webserver when installed on macOS

#76

Post by josteink »

dpkonofa wrote: post #71
josteink wrote: post #14

Earlier quoted context omitted.

> Have these video conferencing services never heard about External Protocol Requests in browsers? Have you tried using them? Then you would know they don’t do that for a good reason. I answered a similar question in the zoom thread: https://news.ycombinator.com/item?id=20389310

This answer and your other answer are basically non-answers. You haven't listed any specific reasons why using them is difficult. Unless you have a specific scenario that applies to enough people, EPRs are the best way to handle this currently in a way that gives the users control over what happens. You shouldn't need to work around these controls.

Well try it yourself then, in a production project, and see what bounce-rates you get with your users.

There’s a reason literally no big companies are using this tech anymore, when they used to do so 10 years ago.

Go on. I’ll be here to say “I told you so”.

Re: BlueJeans also runs a webserver when installed on macOS

#77

Post by ceejayoz »

scarface74 wrote: post #66
ceejayoz wrote: post #42

Earlier quoted context omitted.

Technically? No. It'll largely refuse to run ("App can't be opened because it is from an unidentified developer") if it's not signed via Gatekeeper, though. There's a procedure to bypass that, but it's hardly user-friendly. https://support.apple.com/kb/ph25088?locale=en_US

Yes control click is really complicated.

First, the dialog doesn't give any indication it can be bypassed in that fashion. Second, users should rightfully be suspicious of "just bypass the security!" install instructions - especially non-technical ones.

Re: BlueJeans also runs a webserver when installed on macOS

#78

Post by ghostpepper »

vbezhenar wrote: post #63
ghostpepper wrote: post #13

Earlier quoted context omitted.

By running a web server with the ability to circumvent installation? It could almost be considered a backdoor

User willingly installs their software, they are not backdooring it. There are plenty of services running on every computer, including TCP servers and web servers. If you're going to call them backdoors, you've got a long list.

If I think I have installed your software and it's secretly running a web server with the ability to reinstall itself, I am calling it a backdoor. I think that list is pretty short, but perhaps I am wrong.

Re: BlueJeans also runs a webserver when installed on macOS

#79

Post by scarface74 »

ceejayoz wrote: post #77
scarface74 wrote: post #66

Earlier quoted context omitted.

Yes control click is really complicated.

First, the dialog doesn't give any indication it can be bypassed in that fashion. Second, users should rightfully be suspicious of "just bypass the security!" install instructions - especially non-technical ones.

Because users got a lot of security installing Zoom and BlueJeans since it was signed....

This isn’t unique to these two. Dropbox does some ungodly things when installed on the Mac....

Re: BlueJeans also runs a webserver when installed on macOS

#80

Post by AgloeDreams »

amluto wrote: post #64
josteink wrote: post #22

Earlier quoted context omitted.

> Wow that is really damning, trashing user security in trade to remove a single click As someone who has had to develop and maintain a similar web-to-desktop bridge I can tell you that this one issue was responsible for around 90% of my company’s total support requests, despite only being a small feature in a optional addon in one of our main products. For businesses just trying to keep their customers happy, this p…

And this is why the web browser vendors need to simply disallow this behavior. Websites seem to think they seem to engage in awful behavior to compete with each other. If the browsers just block it outright, then everyone will be on a level playing field.

Thats kinda what happened here, Apple made the user confirm that they were going to take an action on an app on their computer and Zoom built functionality in on the app to bypass it.
Post reply on HN