Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

BlueJeans also runs a webserver when installed on macOS

support.bluejeans.com

Post reply on HN
Print view View original

91–98 of 98 posts

Re: BlueJeans also runs a webserver when installed on macOS

#91

Post by gergles »

scarface74 wrote: post #61
chrisfinazzo wrote: post #56

Earlier quoted context omitted.

Wait a while. Holding one's breath not recommended. For those who don't want to (or cannot, due to the nature of their application) use the Mac App Store to distribute software, the requirements will only continue to get more specific until (to the extent possible) all executable code and resources are notarized and signed with an identity.

This same prediction has been going on since 10.6 - over 7 versions ago. How do you propose that Apple forces code signing on programs that run on top of a VM like the CLR or JVM? How do you propose they enforce it for programs run using a scripting language? The best they could do is force signing on the runtimes. But my point still stands. Today on July 9th 2019 you are not forced to be part of the developer progra…

Today, on July 9, 2019, yes you are not forced to be part of the developer program.

Apple has announced that is changing very soon[0] and you attacking everyone who already knows this as 'conspiracy theorists' is kind of insulting.

0: https://developer.apple.com/documentation/security/notarizin... - "Beginning in macOS 10.15, notarization is required by default for all software".

You can only have software notarized as a member of the developer program.

Re: BlueJeans also runs a webserver when installed on macOS

#92

Post by scarface74 »

gergles wrote: post #91
scarface74 wrote: post #61

Earlier quoted context omitted.

This same prediction has been going on since 10.6 - over 7 versions ago. How do you propose that Apple forces code signing on programs that run on top of a VM like the CLR or JVM? How do you propose they enforce it for programs run using a scripting language? The best they could do is force signing on the runtimes. But my point still stands. Today on July 9th 2019 you are not forced to be part of the developer progra…

Today, on July 9, 2019, yes you are not forced to be part of the developer program. Apple has announced that is changing very soon[0] and you attacking everyone who already knows this as 'conspiracy theorists' is kind of insulting. 0: https://developer.apple.com/documentation/security/notarizin... - "Beginning in macOS 10.15, notarization is required by default for all software". You can only have software notarized…

My statement was very clear “developers are not forced to be part of the developer program.” Meaning that unlike ios, there are ways to distribute your app without signing it. “Notarization required by default” != “there is no method to distribute unsigned apps”.

https://www.google.com/amp/s/eclecticlight.co/2019/06/07/not...

Catalina still runs apps which haven’t been notarized or even signed, including those built after 1 June 2019. But you may find them more complex to run, and they don’t of course benefit from any of new security protection unless they’re signed and hardened.

Re: BlueJeans also runs a webserver when installed on macOS

#93

Post by gergles »

scarface74 wrote: post #92
gergles wrote: post #91

Earlier quoted context omitted.

Today, on July 9, 2019, yes you are not forced to be part of the developer program. Apple has announced that is changing very soon[0] and you attacking everyone who already knows this as 'conspiracy theorists' is kind of insulting. 0: https://developer.apple.com/documentation/security/notarizin... - "Beginning in macOS 10.15, notarization is required by default for all software". You can only have software notarized…

My statement was very clear “developers are not forced to be part of the developer program.” Meaning that unlike ios, there are ways to distribute your app without signing it. “Notarization required by default” != “there is no method to distribute unsigned apps”. https://www.google.com/amp/s/eclecticlight.co/2019/06/07/not... Catalina still runs apps which haven’t been notarized or even signed, including those built…

You left out the portion of the article that says only apps you built yourself don't need to be signed/notarized.

Apps distributed over the Internet, like, you know, the ones we're talking about, must be notarized according to your own source.

Re: BlueJeans also runs a webserver when installed on macOS

#94

Post by scarface74 »

gergles wrote: post #93
scarface74 wrote: post #92

Earlier quoted context omitted.

My statement was very clear “developers are not forced to be part of the developer program.” Meaning that unlike ios, there are ways to distribute your app without signing it. “Notarization required by default” != “there is no method to distribute unsigned apps”. https://www.google.com/amp/s/eclecticlight.co/2019/06/07/not... Catalina still runs apps which haven’t been notarized or even signed, including those built…

You left out the portion of the article that says only apps you built yourself don't need to be signed/notarized. Apps distributed over the Internet, like, you know, the ones we're talking about, must be notarized according to your own source.

What part of Catalina still runs apps which haven’t been notarized or even signed, including those built after 1 June 2019. But you may find them more complex to run

Is difficult to understand? In Catalina just like in the current OS, there is a built in method for the end user to bypass code signing for any app. The user can choose to run unsigned third party code.

The article states that code you create doesn’t have to be signed and you don’t have to go through the “complex” process to run it.

Third party code forces you to go through the “complex” task of ctrl clucking.

Re: BlueJeans also runs a webserver when installed on macOS

#95

Post by josteink »

prophesi wrote: post #81
josteink wrote: post #76

Earlier quoted context omitted.

Well try it yourself then, in a production project, and see what bounce-rates you get with your users. There’s a reason literally no big companies are using this tech anymore, when they used to do so 10 years ago. Go on. I’ll be here to say “I told you so”.

I'm looking at Slack, Steam, and any Email client ever (granted, mailto opening an external app has been standard practice for ages). I'm not sure if I know of any big companies that surreptitiously run a local web-server to save users a click whom haven't received flak for it.

You misunderstand.

I'm not advocating running a local web-server. That's bad.

What I'm saying is that none of the big actors are using custom protocols anymore even though lots of them used to, because browser security policies have rendered them useless for regular end-user interaction.

They have all found other approaches instead. (Some bad, like here. Others better, like the solutions I chose instead).

Re: BlueJeans also runs a webserver when installed on macOS

#96

Post by sodabrew »

Logitech also runs a local webserver. It's listening on port 4800. I've never even used a Logitech video conference. I do have a Logitech camera though, so perhaps this is from the driver.

/Library/Application Support/Logitech/com.logitech.vc.LogiVCCoreService/LogiVCCoreService.app/Contents/MacOS/LogiVCCoreService

Re: BlueJeans also runs a webserver when installed on macOS

#97

Post by basch »

zelon88 wrote: post #46

Typical "My functionality is the only thing that matters" pretentious mindset. It's a general purpose personal computer. Not some device you sold me which exists for the purpose of solely connecting to your app. Let's treat automobiles the same way you'd like us to treat computers. I go to a Shell station to fill up with gas. They have custom nozzles, and I have to drill a hole and weld on a special fitting to get ga…

It's a bit of an arms race between bluejeans, zoom, webex, gotmeeting, teams for who can get people into a meeting with the least friction. The people requesting meetings are probably also the ones requesting "make it easier for people to get into my meetings."

Re: BlueJeans also runs a webserver when installed on macOS

#98

Post by sabbour »

goerz wrote: post #35
vbezhenar wrote: post #9

Earlier quoted context omitted.

How is it trashing user security?

I don't think I understand the security implications of this either. Seems distasteful, but how could it be exploited?

https://www.wired.com/story/zoom-bug-webcam-hackers/
Post reply on HN