Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BlueJeans also runs a webserver when installed on macOS

support.bluejeans.com

Post reply on HN
Print view View original

81–90 of 98 posts

Re: BlueJeans also runs a webserver when installed on macOS

#81

Post by prophesi »

josteink wrote: post #76
dpkonofa wrote: post #71

Earlier quoted context omitted.

This answer and your other answer are basically non-answers. You haven't listed any specific reasons why using them is difficult. Unless you have a specific scenario that applies to enough people, EPRs are the best way to handle this currently in a way that gives the users control over what happens. You shouldn't need to work around these controls.

Well try it yourself then, in a production project, and see what bounce-rates you get with your users. There’s a reason literally no big companies are using this tech anymore, when they used to do so 10 years ago. Go on. I’ll be here to say “I told you so”.

I'm looking at Slack, Steam, and any Email client ever (granted, mailto opening an external app has been standard practice for ages).

I'm not sure if I know of any big companies that surreptitiously run a local web-server to save users a click whom haven't received flak for it.

Re: BlueJeans also runs a webserver when installed on macOS

#82

Post by monocasa »

scarface74 wrote: post #75
monocasa wrote: post #72

Earlier quoted context omitted.

Can you expand? I'm not sure what your comment means.

You said there are “about 100 pages of terms and conditions you have to agree to”. There are six pages.

I literally just went through them at work in preparation for Catalina. They're hidden behind the developer account stuff you need to get your certs registered.

Re: BlueJeans also runs a webserver when installed on macOS

#83

Post by amluto »

AgloeDreams wrote: post #80
amluto wrote: post #64

Earlier quoted context omitted.

And this is why the web browser vendors need to simply disallow this behavior. Websites seem to think they seem to engage in awful behavior to compete with each other. If the browsers just block it outright, then everyone will be on a level playing field.

Thats kinda what happened here, Apple made the user confirm that they were going to take an action on an app on their computer and Zoom built functionality in on the app to bypass it.

No, you’re misunderstanding me. Websites should not be able to talk to localhost over HTTP. Browser vendors should eliminate the back channel.

Re: BlueJeans also runs a webserver when installed on macOS

#84

Post by chrisfinazzo »

scarface74 wrote: post #61
chrisfinazzo wrote: post #56

Earlier quoted context omitted.

Wait a while. Holding one's breath not recommended. For those who don't want to (or cannot, due to the nature of their application) use the Mac App Store to distribute software, the requirements will only continue to get more specific until (to the extent possible) all executable code and resources are notarized and signed with an identity.

This same prediction has been going on since 10.6 - over 7 versions ago. How do you propose that Apple forces code signing on programs that run on top of a VM like the CLR or JVM? How do you propose they enforce it for programs run using a scripting language? The best they could do is force signing on the runtimes. But my point still stands. Today on July 9th 2019 you are not forced to be part of the developer progra…

Not to put too fine a point on it, but those examples don't pass muster.

- If you're not using .NET, the CLR doesn't affect you, and although Microsoft has done well with ,NET, I wouldn't necessarily expect Apple to make Redmond's job easier.

- Java is much the same boat, and is perhaps in even worse shape as it used to be included by default in macOS releases but now isn't.

Read: security nightmare.

- From 10.16 on, scripting languages also aren't included by default. This seems less adversarial than the situation with Java, but for things like Homebrew, it's a stumbling block they will need to overcome.

https://discourse.brew.sh/t/mac-os-deprecating-system-script...

Re: BlueJeans also runs a webserver when installed on macOS

#85

Post by scarface74 »

chrisfinazzo wrote: post #84
scarface74 wrote: post #61

Earlier quoted context omitted.

This same prediction has been going on since 10.6 - over 7 versions ago. How do you propose that Apple forces code signing on programs that run on top of a VM like the CLR or JVM? How do you propose they enforce it for programs run using a scripting language? The best they could do is force signing on the runtimes. But my point still stands. Today on July 9th 2019 you are not forced to be part of the developer progra…

Not to put too fine a point on it, but those examples don't pass muster. - If you're not using .NET, the CLR doesn't affect you, and although Microsoft has done well with ,NET, I wouldn't necessarily expect Apple to make Redmond's job easier. - Java is much the same boat, and is perhaps in even worse shape as it used to be included by default in macOS releases but now isn't. Read: security nightmare. - From 10.16 on,…

Apple introduced the Mac App Store over a decade ago. Since then, conspiracy theorists have been predicting that Apple will force all apps to be signed.

Are you predicting that Apple will disallow all scripting language runtimes and all VM based development environments? So if these same predictions have been wrong for over a decade - and still aren’t happening with 10.13, exactly when will this happen?

As far as Apple not including (outdated) versions of various scripting languages or Java - neither does Microsoft. That hasn’t been a major impediment to adoption.

Re: BlueJeans also runs a webserver when installed on macOS

#86

Post by p_l »

nickdandakis wrote: post #48
josteink wrote: post #22

Earlier quoted context omitted.

> Wow that is really damning, trashing user security in trade to remove a single click As someone who has had to develop and maintain a similar web-to-desktop bridge I can tell you that this one issue was responsible for around 90% of my company’s total support requests, despite only being a small feature in a optional addon in one of our main products. For businesses just trying to keep their customers happy, this p…

Did your company try to write an FAQ page on how to accept the double-confirm dialogs in all major browsers (with screenshots) to maybe reduce your "90% of support tickets"? Does your ticketing software redirect you to (or display) an FAQ page that matches the ticket title? I've come to understand how features like these get built, but I've also come to understand that people that use software are a lot more resilien…

Ahhh, sweet naivety.

The people who end up calling support often aren't the ones paying the bill, for starters. That's definitely the case for Bluejeans and Zoom.

It also doesn't matter if you make a great FAQ page. Majority of dissatisfied people will never see it. Majorly because they won't call support but instead complain and grumble locally, the second biggest portion because once sent towards FAQ by support.... They won't follow it.

Only the tiny sliver of most dedicated will follow up long enough to reach the FAQ.

Re: BlueJeans also runs a webserver when installed on macOS

#87

Post by chrisfinazzo »

scarface74 wrote: post #85
chrisfinazzo wrote: post #84

Earlier quoted context omitted.

Not to put too fine a point on it, but those examples don't pass muster. - If you're not using .NET, the CLR doesn't affect you, and although Microsoft has done well with ,NET, I wouldn't necessarily expect Apple to make Redmond's job easier. - Java is much the same boat, and is perhaps in even worse shape as it used to be included by default in macOS releases but now isn't. Read: security nightmare. - From 10.16 on,…

Apple introduced the Mac App Store over a decade ago. Since then, conspiracy theorists have been predicting that Apple will force all apps to be signed. Are you predicting that Apple will disallow all scripting language runtimes and all VM based development environments? So if these same predictions have been wrong for over a decade - and still aren’t happening with 10.13, exactly when will this happen? As far as App…

Sigh, you're just not getting it, sorry to say.

I have NO TROUBLE imagining that Apple will continue to tighten the screws on this, enforcing signing through Developer TOS and requiring MAS apps to pay for distribution certs.

Direct download isn't going away, not after all the work that's gone into securing it, but if you think you can sell an app off your own site without giving Apple some identifiable info about who you are and what your code does, prepare to be disappointed.

Runtimes won't be disallowed, just that you (the user) are responsible for installing them and keeping things updated.

Oh, and for record, my reference to "Perry the Cynic" is no accident...he literally invented how code signing works.

https://weblog.rogueamoeba.com/2008/03/07/code-signing-and-y...

https://red-sweater.com/blog/514/development-phase-code-sign...

http://patft.uspto.gov/netacgi/nph-Parser?Sect2=PTO1&Sect2=H...

http://patft.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=H...

Re: BlueJeans also runs a webserver when installed on macOS

#88

Post by scarface74 »

chrisfinazzo wrote: post #87
scarface74 wrote: post #85

Earlier quoted context omitted.

Apple introduced the Mac App Store over a decade ago. Since then, conspiracy theorists have been predicting that Apple will force all apps to be signed. Are you predicting that Apple will disallow all scripting language runtimes and all VM based development environments? So if these same predictions have been wrong for over a decade - and still aren’t happening with 10.13, exactly when will this happen? As far as App…

Sigh, you're just not getting it, sorry to say. I have NO TROUBLE imagining that Apple will continue to tighten the screws on this, enforcing signing through Developer TOS and requiring MAS apps to pay for distribution certs. Direct download isn't going away, not after all the work that's gone into securing it, but if you think you can sell an app off your own site without giving Apple some identifiable info about wh…

So you realize you’re kind of arguing against your point? He made a prediction that still hasn’t come true over a decade later.

And citing the patent office isn’t helping either. Every company patents everything they can.

Direct download isn't going away, not after all the work that's gone into securing it, but if you think you can sell an app off your own site without giving Apple some identifiable info about who you are and what your code does, prepare to be disappointed.

Well today you can. As you have been able to do since the info-Mac archives since before the World Wide Web existed. So unless you can bring back some proof from either your time machine or visiting some other world in the multiverse, I would rather talks about facts as they exist today.

And code signing still won’t stop you from being able to run code that runs on top of a VM or scripting languages without them being signed and you won’t have to do the ctrl-click bypass.

Why is it wrong for Apple not to bundle extra runtimes (scripting/JVM) software that increases the attack surface? Should they also start back bundling Flash?

Re: BlueJeans also runs a webserver when installed on macOS

#89

Post by chrisfinazzo »

scarface74 wrote: post #88
chrisfinazzo wrote: post #87

Earlier quoted context omitted.

Sigh, you're just not getting it, sorry to say. I have NO TROUBLE imagining that Apple will continue to tighten the screws on this, enforcing signing through Developer TOS and requiring MAS apps to pay for distribution certs. Direct download isn't going away, not after all the work that's gone into securing it, but if you think you can sell an app off your own site without giving Apple some identifiable info about wh…

So you realize you’re kind of arguing against your point? He made a prediction that still hasn’t come true over a decade later. And citing the patent office isn’t helping either. Every company patents everything they can. Direct download isn't going away, not after all the work that's gone into securing it, but if you think you can sell an app off your own site without giving Apple some identifiable info about who yo…

> Well today you can. As you have been able to do since the info-Mac archives since before the World Wide Web existed. So unless you can bring back some proof from either your time machine or visiting some other world in the multiverse, I would rather talks about facts as they exist today.

Watch WWDC 2019 Session 701, you'll learn something.

https://developer.apple.com/videos/play/wwdc2019/701/

> And code signing still won’t stop you from being able to run code that runs on top of a VM or scripting languages without them being signed and you won’t have to do the ctrl-click bypass.

It is easy to do this? No, in many cases I'd expect it to be a serious P.I.T.A, but it's unquestionably the right move going forward.

https://mjtsai.com/blog/2019/06/17/notarizing-command-line-t...

Re: BlueJeans also runs a webserver when installed on macOS

#90

Post by scarface74 »

chrisfinazzo wrote: post #89
scarface74 wrote: post #88

Earlier quoted context omitted.

So you realize you’re kind of arguing against your point? He made a prediction that still hasn’t come true over a decade later. And citing the patent office isn’t helping either. Every company patents everything they can. Direct download isn't going away, not after all the work that's gone into securing it, but if you think you can sell an app off your own site without giving Apple some identifiable info about who yo…

> Well today you can. As you have been able to do since the info-Mac archives since before the World Wide Web existed. So unless you can bring back some proof from either your time machine or visiting some other world in the multiverse, I would rather talks about facts as they exist today. Watch WWDC 2019 Session 701, you'll learn something. https://developer.apple.com/videos/play/wwdc2019/701/ > And code signing sti…

That has nothing to do with distributing the programs that run on top of VMs/runtimes. The operating system only sees the JVM/CLR as an executable. Even if that has to be signed, there is no way of enforcing the programs that run on top of them to be signed.
Post reply on HN