Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

71–80 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#71

Earlier quoted context omitted.

That's Apple's closed garden, even when they allow you to sideload application, they still have the ultimate decision. Of course it's not malware, but probably enough users have vulnerable software which could be remotely exploited, that they decided to blacklist it.

A program that surreptitiously reinstalls software when you uninstall it is by definition malware. A piece of software that lets any website activate your camera without your permission is a security vulnerability.

Malware is a software written to harm user. Their purpose was not to harm user, they wanted to make their service more convenient for users. Bugs are bugs, every product have bugs and many products have security bugs. That does not make them malware.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#74

I always wondered why the zoom app required root permissions, which is why I never installed it in the first place. What would a video conferencing app ever need root permissions for?! Now we know: a backdoor. Thank god for Apple putting down the law. This is why I happily pay premium prices...

I can't verify since I don't have it installed but I see no reason why this webserver would need root permissions. If it's asking for root it must be for something else.

Maybe an improved ability to remain persistent after uninstall, and to reinstall the app?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#75

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

Neither does Windows or Linux. I don't think you can have such a standardized way on a flexible general-purpose OS.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#76
post #69

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

I don't think disabling the enterprise certs was particularly moral, Facebook and Google were flagrantly violating the terms of the enterprise program. Apple also apparently didn't even notice (or didn't care) until articles about it started getting a lot of attention. Apple definitely does make some commendable decisions, but I think it's also important to distinguish between bravery and what Ben Thompson calls "Str…

Indeed a company's "morals" are better exposed when it has to make inconvenient choices.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#77

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

It does provide a standard way to uninstall an app: drag it to the trash can.

I would say that what Zoom did was have their app intentionally install malware that bypassed this normal uninstall.

I do think that it would be great to have a more thoroughly sandboxed idea of what an “app” is on the desktop, though.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#78

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

>The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app. reply

And Windows does? Uninstallers are completely at the behest of application developers. No consumer OS but iOS actually provides any sort of true app level sandboxing.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#79

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

Nor does Windows for that matter. Running installshield with some command line parameter doesn't count. Linux package managers come close, but not all third party apps are installed like that.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#80

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

Zoom deliberately circumvented Apple's standard package format, contrary to security interests. Zoom is basically behaving like a virus here.
Post reply on HN