Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

101–110 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#101

Post by RussianCow »

javagram wrote: post #96
aphextron wrote: post #78

Earlier quoted context omitted.

>The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app. reply And Windows does? Uninstallers are completely at the behest of application developers. No consumer OS but iOS actually provides any sort of true app level sandboxing.

> And Windows does? Control Panel “add and remove programs” usually works? There’s no equivalent on Mac. Yes, dragging the app to the trash is a thing but that leaves behind content in ~/Library/caches, ~/Library/Application Support, and ~/Library/Preferences . It’s been somewhat of an issue with Mac ever since they first put a hard drive on the original ones back in the 80s... Edit: I literally cleared several GB of…

The point is, all of those files are generally still left behind on Windows as well. Uninstalling a program in Windows is roughly equivalent to dragging it into the trash in macOS.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#102

Post by londons_explore »

duxup wrote: post #93
eddieplan9 wrote: post #58

Earlier quoted context omitted.

Because zoom’s patch will only help users still using and updating zoom while those who have uninstalled zoom are still vulnerable (because the uninstalled leaves the web server behind)

"(because the uninstalled leaves the web server behind)" For cripes sake...

Because macos has no decent concept of package management or containerization.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#103

Post by rrix2 »

duxup wrote: post #93
eddieplan9 wrote: post #58

Earlier quoted context omitted.

Because zoom’s patch will only help users still using and updating zoom while those who have uninstalled zoom are still vulnerable (because the uninstalled leaves the web server behind)

"(because the uninstalled leaves the web server behind)" For cripes sake...

It bothers me that people weren't more upset about this part.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#104

Post by duncanawoods »

wwright wrote: post #81
curt15 wrote: post #76

Earlier quoted context omitted.

Indeed a company's "morals" are better exposed when it has to make inconvenient choices.

I would say true morals lead to structuring your company in such a way that you don’t have to rely on business people making ethical decisions moment to moment, because they won’t.

As nice as that sounds, I think it requires an impossibly perfect prediction of future events. You face ethical decisions whenever you have power or limited resources.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#105

Post by msbarnett »

snuxoll wrote: post #60
msbarnett wrote: post #32

Earlier quoted context omitted.

I haven’t checked, but are you looking at the version of the binary itself, or the MRT signature files it uses

Checked XProtect.meta.plist inside the app bundle, forcing an update check with softwareupdate has no impact either. Perhaps it’s a staged rollout, but at least on my iMac there’s no sign of updated signatures.

Yeah you’re just looking at the version of the xprotect binary, not the malware signature data files, which don’t live in the bundle and get updated more regularly.

They also ship silently via system_installd, you’re not going to see anything in the software update GUI

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#106

Post by etbebl »

javagram wrote: post #96
aphextron wrote: post #78

Earlier quoted context omitted.

>The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app. reply And Windows does? Uninstallers are completely at the behest of application developers. No consumer OS but iOS actually provides any sort of true app level sandboxing.

> And Windows does? Control Panel “add and remove programs” usually works? There’s no equivalent on Mac. Yes, dragging the app to the trash is a thing but that leaves behind content in ~/Library/caches, ~/Library/Application Support, and ~/Library/Preferences . It’s been somewhat of an issue with Mac ever since they first put a hard drive on the original ones back in the 80s... Edit: I literally cleared several GB of…

Doesn't "Add and Remove Programs" just run whatever custom Uninstaller came bundled with the program? Is there anything it can do with programs that don't come with an uninstaller?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#107

Post by Operyl »

londons_explore wrote: post #102
duxup wrote: post #93

Earlier quoted context omitted.

"(because the uninstalled leaves the web server behind)" For cripes sake...

Because macos has no decent concept of package management or containerization.

I mean. The issue at hand was that they purposely left the webserver behind to auto reinstall if a zoom link was clicked. This was an intended feature, and the same could have been done on Linux or Windows. Package management or containers are irrelevant to this conversation.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#108

Post by snuxoll »

msbarnett wrote: post #105
snuxoll wrote: post #60

Earlier quoted context omitted.

Checked XProtect.meta.plist inside the app bundle, forcing an update check with softwareupdate has no impact either. Perhaps it’s a staged rollout, but at least on my iMac there’s no sign of updated signatures.

Yeah you’re just looking at the version of the xprotect binary, not the malware signature data files, which don’t live in the bundle and get updated more regularly. They also ship silently via system_installd, you’re not going to see anything in the software update GUI

The signature files also live inside the XProtect.app bundle, unless in true Apple fashion they’ve got other stuff that’s lurking elsewhere in /System that I can’t locate.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#109

Post by bandushrew »

londons_explore wrote: post #102
duxup wrote: post #93

Earlier quoted context omitted.

"(because the uninstalled leaves the web server behind)" For cripes sake...

Because macos has no decent concept of package management or containerization.

that is explicitly incorrect. macos has a very nice and effective way of packaging all the components needed by an app into tidy bundles.

the problem in this case is that the developers just couldn't be assed even trying.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#110

Post by userbinator »

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating things like OS files, for example. Some other comments here suggest that the installation of this update is controlled by a setting described as being for system related updates, which a user would expect to leave his/her third-party software alone.)

You may agree with its decision this time, but will you always agree? Apple's wielding of power in this way is likely to attract the attention of groups such as copyright/IP lobbyists, which have an immense desire to have all "non-authorised" files/software erased from all user's machines.

As the saying goes, "two wrongs don't make a right".

In any case, the idea of the OS/platform vendor meddling with third-party software that it doesn't like just feels wrong. I know Apple has historically held tight control over its mobile platforms, but the Mac is meant to be different.

I am not an Apple customer, and I now feel even more reluctant to become one.

Post reply on HN