Amusingly enough, the standard menu position for Quit on the Mac is at the bottom of the menu… _now_ the Uninstall Zoom option is at the bottom of the menu, making it easy to accidentally invoke if you're used to selecting the last item there to quit. (I happened to have my hand on the mouse rather than keyboard at the time… normally I'd just cmd-Q).
Zoom fixes major Mac webcam security flaw with emergency patch
41–50 of 151 posts
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#42I'm confused. Does the patch now make it to where if you drag the app to the trash, it actually uninstalls?
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#43Does anyone know if this issue (and the BlueJeans one) would only affect the current user account?
I currently have a separate limited user account just for meetings, and that’s where I install various meeting apps. So in my case is there any way to know if it affected all my accounts or just the one?
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#44I'm confused. Does the patch now make it to where if you drag the app to the trash, it actually uninstalls?
First, does the patch actually fixes it? In original report, they "patched" it with the flaw remaining.
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#45Glad to see the company is changing course, but I’m not sure it would have happened without the public shaming. I want companies to fix things because something is insecure and it endangers the public, not because they have their feet to the fire. I know companies don’t always respond right the first time, I know I haven’t, but Zoom had over 90 days to consider their responses and possible options / software changes.…
And this is why anyone who trusts that organization in any way moving forward is a fool.
Nah leadership can change, see Microsoft and apple
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#46Earlier quoted context omitted.
Anger is certainly justified, but it should give way to reconciliation once the offending party truly repents. Do we want a world of people who change their ways, even if for somewhat impure reasons, or a world in which no one ever does because it's pointless?
They haven’t repented yet, though. Read their response.
No patch? What the actual fuck
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#47Earlier quoted context omitted.
Exactly. My company is actively shopping for a conferencing tool, and Zoom just ensured that it's eliminated.
Anger is certainly justified, but it should give way to reconciliation once the offending party truly repents. Do we want a world of people who change their ways, even if for somewhat impure reasons, or a world in which no one ever does because it's pointless?
We should definitely treat people as human beings and understand we're all fallible, we should try to forgive mistakes, and we should hope people learn when they get something wrong. That said, if someone does something to make us stop trusting them it's on them to show they've changed; it requires effort from both parties.
There is no reason to extend this philosophy to corporations though. We can decide to use a competitor instead. No one needs to show loyalty to a supplier who screwed up.
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#48What about users who had previously uninstalled the Zoom client? Must they now reinstall Zoom in order to be able to fully remove it? Surely there are users that won’t perform the manual update and will remain vulnerable indefinitely.
Although I agree having an active webserver with dubious security controls is a problem, the vulnerability as we know it today installs Zoom... and this new version of Zoom uninstalls the webserver. So it is (or at least could be) a self-patching vulnerability.
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#49What about users who had previously uninstalled the Zoom client? Must they now reinstall Zoom in order to be able to fully remove it? Surely there are users that won’t perform the manual update and will remain vulnerable indefinitely.
I believe rm -rf ~/.zoomus should do the trick
Re: Zoom fixes major Mac webcam security flaw with emergency patch
#50Of the main facets of the problem, the vulnerability bothered me less than their obviously poor attitude towards fixing it in a responsible timeline, and that bothered me less than the discovery that they were running an always-active webserver to assist call launches and reinstallation. Is that a common thing that programs do? Should I be expected to portscan myself frequently to see if software is unexpectedly runn…
Not only is it common, there was an article about "how to write performant electron apps" at the top of HN last week explaining exactly why you should do that.
While Electron apps have the ability to introduce a security nightmare (just like every desktop app framework really), the authors do try to teach Electron users how to make the apps they develop a bit more secure - https://github.com/electron/electron/blob/master/docs/tutori...