Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

141–150 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#141
post #77

Earlier quoted context omitted.

It does provide a standard way to uninstall an app : drag it to the trash can. I would say that what Zoom did was have their app intentionally install malware that bypassed this normal uninstall. I do think that it would be great to have a more thoroughly sandboxed idea of what an “app” is on the desktop, though.

Snapd, flatpak, appimage all can do this on Linux. Even docker/singularity can sort of do the same for some, if you pass through all the necessary devices and sockets from the host. When you remove the app (or container) all the files it brought with it or created during runtime are now gone. Even the regular Linux package managers like apt, dnf, pacman track which files were installed by which packages, so they can…

> all the files it brought with it or created during runtime are now gone.

How would this work with apps that create things that a user would expect to persist, like downloads (kept after uninstalling a browser) or office documents (kept after uninstalling the office suite), or media production apps, IDEs, etc.?

It could have some rule like "let it be if it's in the user home directory" or "only remove stuff in these system directories" but it seems kind of fragile, like what if you use a text editor to create a system config file and then uninstall the text editor?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#142
I was thinking to myself “it is too bad Apple can’t just disable this like they could have on iOS, cause I suspect most people I know with Macs would be vulnerable to it and it is next to impossible to explain to a nontechnical user how to actually uninstall this”.

Kudos to Apple for nuking this malware.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#143

Earlier quoted context omitted.

Which is completely frustrating, because Mac is totally in the position of using its built-in capabilities to deal with this. The Mac Bundle (.app) format could solve this entirely. All application specific data should be written inside of the bundle folder, so that when you delete the app, you delete the thing entirely. I mean, maybe you need a "user data" bundle of sorts tied to the specific application. If you del…

> The default installer and bundle runners should be controlling the process. "XYZ App is attempting to write data files outside of its bundle location. These may not be cleaned up if you delete the application. Do you want to continue?" If you do that, the entire system stops working. Everyone will just click "ok" and then still gets mad when uninstalling doesn't fully clean things up.

Well, that's fair. But hopefully in the process of getting mad, it starts to reflect negatively on the application vendors and/or Apple directly. Maybe that will be enough for them to change.

Maybe the app bundle runner should be logging files written outside of the bundle folder? Then the uninstall process will wipe those out?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#144

Earlier quoted context omitted.

Because macos has no decent concept of package management or containerization.

that is explicitly incorrect. macos has a very nice and effective way of packaging all the components needed by an app into tidy bundles. the problem in this case is that the developers just couldn't be assed even trying.

No, the de vintentionally circumvented the bundling and containerization that exists, and MacOS couldn't prevent it. That said, Windows and Linux can't prevent it either, in common configurations.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#145

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

Does Windows not distribute automated tools via Windows Updates from time-to-time to remove Malware _and_ PUP (Potentially Unwanted Programs). I'd argue that the entire Zoom debacle is probably a PUP since a user _uninstalled_ Zoom. And the Zoom web server can _reinstall_ Zoom.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#146

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

I find it pretty hard to make sense of an argument that frames the removal of trivially exploitable, extremely privacy-violating malware from users' systems as a 'wrong'. The software itself continues to work and was minimally affected, if at all. If quickly intervening to protect your customers' privacy from an egregious threat is wrong, I want all my vendors to be wrong.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#147

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

lol they removed what would be called horrific spyware if it wasn’t made by Zoom and you’re over here on some lofty criticism about possible implications years into the future any OS (and many other apps) that update have the power to do what you’re afraid of, and much more. plus i don’t really see a bright line between system level software and an app when apps can access your video cam, mic, all your files - basica…

That's it right there. This isn't some gray area, questionable thing like that time they pushed a David Bowie song onto people's iTunes. Remember that? People completely lost their minds over it, and I agree with the sentiment.

This isn't third-party anything. No one even knew this was running on their machine and it was demonstrably abusable. Good riddance!

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#148

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

Which is completely frustrating, because Mac is totally in the position of using its built-in capabilities to deal with this. The Mac Bundle (.app) format could solve this entirely. All application specific data should be written inside of the bundle folder, so that when you delete the app, you delete the thing entirely. I mean, maybe you need a "user data" bundle of sorts tied to the specific application. If you del…

I'd argue that linux distros have this power, too, and they haven't either (unless you use a snap, which has compatibility and performance issues).

If you uninstall a .deb or .rpm or AppImage, the files you wrote into XDG_CONFIG_HOME (defaults to ~/.config) won't magically get cleaned up.

I'd love to be wrong here, BTW! I've had several PhotoStructure users try to reset their configuration by uninstall/reinstall, but that just removes the files in the installer, it doesn't do anything to files in user directories (and I'd be really surprised if that was ever a thing). Can you imagine the havoc from `apt remove vscode` and having it remove user's keybindings, extensions, and anything else?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#149
post #42

This means there might have been another side to this story: Zoom's change of heart might have been forced by Apple, not the public backlash. Apple: Hey, your app poses a threat to macOS security. We're going to remove your server app with the built-in macOS anti-virus. Zoom: Oh crap. Okay, give us 2 sprints to release a new version that removes it. Apple: We're killing it in 48 hours. ... Zoom, after an all-nighter:…

[deleted]

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#150

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

There are reports there was another RCE that Zoom didn’t/wouldn’t fix. This is what Gatekeeper and the built-in anti-malware engine is suppose to do — remove malware. If you don’t want this feature, you can turn it off, but this is a sane default and a good thing.

Apple didn’t flex anything here, it removed malware from its users computers.

https://twitter.com/riskybusiness/status/1148824808236318721

Post reply on HN