Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

81–90 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#81

Post by wwright »

curt15 wrote: post #76
Deimorz wrote: post #69

Earlier quoted context omitted.

I don't think disabling the enterprise certs was particularly moral, Facebook and Google were flagrantly violating the terms of the enterprise program. Apple also apparently didn't even notice (or didn't care) until articles about it started getting a lot of attention. Apple definitely does make some commendable decisions, but I think it's also important to distinguish between bravery and what Ben Thompson calls "Str…

Indeed a company's "morals" are better exposed when it has to make inconvenient choices.

I would say true morals lead to structuring your company in such a way that you don’t have to rely on business people making ethical decisions moment to moment, because they won’t.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#82

Post by fastball »

millstone wrote: post #75
xeeeeeeeeeeenu wrote: post #72

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

Neither does Windows or Linux. I don't think you can have such a standardized way on a flexible general-purpose OS.

What apple should do though is provide an API that developers can hook into, where in when the user drags the app to the trash, it can also uninstall anything else the app placed elsewhere on the system.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#83

Post by evv »

xeeeeeeeeeeenu wrote: post #72

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

Funny, it is also self-inflicted because Safari inspired Zoom to do this hack by breaking the correct behavior of protocol links.

> This is a workaround to a change introduced in Safari 12 that requires a user to confirm that they want to start the Zoom client prior to joining every meeting. The local web server enables users to avoid this extra click before joining every meeting.

https://blog.zoom.us/wordpress/2019/07/08/response-to-video-...

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#84

Post by shakna »

tjohns wrote: post #24
Twirrim wrote: post #18

Disturbs me somewhat that Apple has a way to silently push changes to laptops without user interaction.

This has been in place since 10.6 Snow Leopard. It's part of their built-in anti-malware system (MRT + XProtect + Gatekeeper). It's no different than a virus scanner auto-updating its signatures.

Except that if you auto-update disabled, you'd be somewhat surprised if the virus scanner could update it's signatures.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#86

Post by outworlder »

jrockway wrote: post #57
chipperyman573 wrote: post #43

Earlier quoted context omitted.

Windows update does the same, no?

Windows Update leaves behind a lot of logs with KB entries, so I don't think they're trying to do anything secretly. If Microsoft changes your software, you know about it.

Nor is Apple. See other comments on this thread.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#87

Post by pkulak »

aphextron wrote: post #78
xeeeeeeeeeeenu wrote: post #72

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

>The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app. reply And Windows does? Uninstallers are completely at the behest of application developers. No consumer OS but iOS actually provides any sort of true app level sandboxing.

Flatpak, Appimage, etc.

Zoom is even available in Flathub, and that's how I use it.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#88

Post by fastball »

javagram wrote: post #64
olliej wrote: post #11

Earlier quoted context omitted.

The server was intentionally left behind, and running, by the "uninstaller". The server would respond to requests by reinstalling the intentionally uninstalled software . That's malware. The server itself was deliberately added to work around a Safari security feature, that was designed specifically to prevent what they wanted: allowing arbitrary web content to open an app without user consent. They literally added a…

> The server was intentionally left behind, and running, by the "uninstaller FWIW, I don’t think there was a uninstaller? What I’ve seen people describe is that dragging the .App file to the trash wouldn’t remove the server, since it was installed in a different folder. There was no uninstaller until the Zoom update this week added an uninstall option to the menu.

I think that is the point.

MacOS users expect an app that does not come bundled with an uninstaller to be "uninstalled" by dragging the .app bundle to the trash. This generally leaves behind metadata, but that is not a big deal as it is just data - not code.

Leaving behind code that continues to execute after the user has removed the application without an option to uninstall it is obviously something that never should have shipped in the first place from a customer trust perspective.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#89

Post by olliej »

javagram wrote: post #64
olliej wrote: post #11

Earlier quoted context omitted.

The server was intentionally left behind, and running, by the "uninstaller". The server would respond to requests by reinstalling the intentionally uninstalled software . That's malware. The server itself was deliberately added to work around a Safari security feature, that was designed specifically to prevent what they wanted: allowing arbitrary web content to open an app without user consent. They literally added a…

> The server was intentionally left behind, and running, by the "uninstaller FWIW, I don’t think there was a uninstaller? What I’ve seen people describe is that dragging the .App file to the trash wouldn’t remove the server, since it was installed in a different folder. There was no uninstaller until the Zoom update this week added an uninstall option to the menu.

There was a reference to an uninstaller in one post, but also it is expected the uninstalling an app on macOS is simply a matter of deleting the app package.

But again, this was deliberately subverted by the client copying the server out of the app package and into a hidden folder in the user's home directory. Again, this is an intentional choice mimicking malware: the only reason to move the server binary is to break the standard app removal process.

But I maintain that the smoking gun for this being intentional is that the server will download and reinstall the client software, which only makes sense if you expect it to run when the user has uninstalled/removed your software.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#90

Post by kevingadd »

outworlder wrote: post #79
xeeeeeeeeeeenu wrote: post #72

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

Nor does Windows for that matter. Running installshield with some command line parameter doesn't count. Linux package managers come close, but not all third party apps are installed like that.

Having a standard installer toolkit that comes with the os and used by many os updates along with a centralized uninstall UI is nothing?
Post reply on HN