Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

121–130 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#121

Post by zaptheimpaler »

userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

lol they removed what would be called horrific spyware if it wasn’t made by Zoom and you’re over here on some lofty criticism about possible implications years into the future

any OS (and many other apps) that update have the power to do what you’re afraid of, and much more.

plus i don’t really see a bright line between system level software and an app when apps can access your video cam, mic, all your files - basically your whole computer.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#122

Post by sjwright »

rrix2 wrote: post #103
duxup wrote: post #93

Earlier quoted context omitted.

"(because the uninstalled leaves the web server behind)" For cripes sake...

It bothers me that people weren't more upset about this part.

I’m sure Apple is as upset as anyone else. It effectively breaks their sandbox model so they’ll probably be working hard on a way to plug that hole gracefully.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#123

Post by tomjakubowski »

krferriter wrote: post #94
wwright wrote: post #77

Earlier quoted context omitted.

It does provide a standard way to uninstall an app : drag it to the trash can. I would say that what Zoom did was have their app intentionally install malware that bypassed this normal uninstall. I do think that it would be great to have a more thoroughly sandboxed idea of what an “app” is on the desktop, though.

Snapd, flatpak, appimage all can do this on Linux. Even docker/singularity can sort of do the same for some, if you pass through all the necessary devices and sockets from the host. When you remove the app (or container) all the files it brought with it or created during runtime are now gone. Even the regular Linux package managers like apt, dnf, pacman track which files were installed by which packages, so they can…

A sandboxed macOS app would offer similar protections as what snapd, flatpak, etc provide on Linux.

> Even the regular Linux package managers like apt, dnf, pacman track which files were installed by which packages, so they can be removed when the package is uninstalled.

Technically speaking, Zoom could have abused dpkg post-install scripts, or pulled similar tricks, to install their malware server and leave it behind after the package was removed. Linux distributions aren't invincible to these shenanigans.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#126

Post by taftster »

xeeeeeeeeeeenu wrote: post #72

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

Which is completely frustrating, because Mac is totally in the position of using its built-in capabilities to deal with this. The Mac Bundle (.app) format could solve this entirely. All application specific data should be written inside of the bundle folder, so that when you delete the app, you delete the thing entirely.

I mean, maybe you need a "user data" bundle of sorts tied to the specific application. If you delete the app, it deletes all the user data bundles as well.

The default installer and bundle runners should be controlling the process. "XYZ App is attempting to write data files outside of its bundle location. These may not be cleaned up if you delete the application. Do you want to continue?"

The unix permissions system and the Mac bundle format should completely solve this problem. I honestly just don't get why this still happens. Doesn't iOS at least get this right?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#127

Post by wwright »

duncanawoods wrote: post #104
wwright wrote: post #81

Earlier quoted context omitted.

I would say true morals lead to structuring your company in such a way that you don’t have to rely on business people making ethical decisions moment to moment, because they won’t.

As nice as that sounds, I think it requires an impossibly perfect prediction of future events. You face ethical decisions whenever you have power or limited resources.

Yeah, I agree, but I think that is just a way of stating that morals are impossible to perfect.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#128

Post by edoceo »

crankylinuxuser wrote: post #118
userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

That's why the only safe OS is indeed Linux. Say, Xubuntu or Fedora. Microsoft has turned the masses into unpaid QA along with extracting their digital wealth. Mac/iOS is a dictatorial wasteland. And Android is adtechs wet dream.

There is only Gentoo. So much control, so free. I've had to manually approve licenses to install fonts. A few other trade offs but I control and own all the bits

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#129

Post by universenz »

fouc wrote: post #63
lilyball wrote: post #49

Earlier quoted context omitted.

I can't verify since I don't have it installed but I see no reason why this webserver would need root permissions. If it's asking for root it must be for something else.

Quite a few apps ask for root during installation. But now you have me wondering which apps ask for root and which don't. Would be neat if there was a huge app registry website that could show this. Name and shame the ones that ask for root..

Let me introduce you to the nice folks over at Objective See.. https://objective-see.com/products.html

They have a bunch of cool little apps (that are free) like BlockBlock that let you know when things are happening you wouldn't have otherwise allowed.

For example, BlockBlock warned me randomly about 30 minutes ago about an app that was being silently installed in the background.. something I hadn't seen before called MRT.app.

Turns out - that was Apple silently updating the OS to protect against Zoom. Wouldn't have known if it weren't for these apps.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#130

Post by fastball »

javagram wrote: post #98
fastball wrote: post #88

Earlier quoted context omitted.

I think that is the point. MacOS users expect an app that does not come bundled with an uninstaller to be "uninstalled" by dragging the .app bundle to the trash. This generally leaves behind metadata, but that is not a big deal as it is just data - not code. Leaving behind code that continues to execute after the user has removed the application without an option to uninstall it is obviously something that never shou…

FWIW I am not sure how dragging the .app to the trash would uninstall other things installed by the app. If I drag photoshop to my trash instead of using Adobe’s uninstaller, I’m pretty sure that leaves Creative Cloud junk running on my machine. Now, zoom did mess up by not having a proper uninstaller shipped with their app, I think a lot of other Mac apps do fail at this too though.

Yes, as is, dragging apps to the trash cannot do that.

Apple should probably implement an API that allows developers to tell the OS what other stuff should be removed if the app is dragged to the trash.

To prevent devs from removing other people's stuff, you could require that the subcomponents need to be cryptographically signed with the same key as the main app bundle.

edit: or, even simpler solution (potentially) - have a fairly basic API via which devs can install subprograms elsewhere on the system. When you use this API to install something, it adds the thing installed to an OS-level registry. When the user drags the app to the trash, the OS checks the registry and removes anything that was added by the application.

Post reply on HN