Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

151–160 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#151

Post by hunter2_ »

taftster wrote: post #143
maxsilver wrote: post #133

Earlier quoted context omitted.

> The default installer and bundle runners should be controlling the process. "XYZ App is attempting to write data files outside of its bundle location. These may not be cleaned up if you delete the application. Do you want to continue?" If you do that, the entire system stops working. Everyone will just click "ok" and then still gets mad when uninstalling doesn't fully clean things up.

Well, that's fair. But hopefully in the process of getting mad, it starts to reflect negatively on the application vendors and/or Apple directly. Maybe that will be enough for them to change. Maybe the app bundle runner should be logging files written outside of the bundle folder? Then the uninstall process will wipe those out?

Wipe out all the things that you create with the app? All the text you created when you uninstall a text editor, the photos you touched up and saved under a new name, the audio recordings you made?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#152

Post by pvg »

heyoni wrote: post #147
zaptheimpaler wrote: post #121

Earlier quoted context omitted.

lol they removed what would be called horrific spyware if it wasn’t made by Zoom and you’re over here on some lofty criticism about possible implications years into the future any OS (and many other apps) that update have the power to do what you’re afraid of, and much more. plus i don’t really see a bright line between system level software and an app when apps can access your video cam, mic, all your files - basica…

That's it right there. This isn't some gray area, questionable thing like that time they pushed a David Bowie song onto people's iTunes. Remember that? People completely lost their minds over it, and I agree with the sentiment. This isn't third-party anything. No one even knew this was running on their machine and it was demonstrably abusable. Good riddance!

a David Bowie song

It was an entire U2 album, a far greater offense.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#153

Post by [deleted] »

heyoni wrote: post #147
zaptheimpaler wrote: post #121

Earlier quoted context omitted.

lol they removed what would be called horrific spyware if it wasn’t made by Zoom and you’re over here on some lofty criticism about possible implications years into the future any OS (and many other apps) that update have the power to do what you’re afraid of, and much more. plus i don’t really see a bright line between system level software and an app when apps can access your video cam, mic, all your files - basica…

That's it right there. This isn't some gray area, questionable thing like that time they pushed a David Bowie song onto people's iTunes. Remember that? People completely lost their minds over it, and I agree with the sentiment. This isn't third-party anything. No one even knew this was running on their machine and it was demonstrably abusable. Good riddance!

[deleted]

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#154

Post by nemothekid »

krferriter wrote: post #99
gaogao wrote: post #66

Earlier quoted context omitted.

Razer gaming keyboard drivers spin up a webserver for controlling the chroma, which I've always found scary. (Using the much more reasonable community open source drivers that don't do that.)

Why in the world would a keyboard driver need to run a webserver? Client software should just be able to call driver functions directly in order to configure the keyboard. It sounds like they hired a web developer to write their driver configuration tool and didn't give any architectural constraints or have someone managing the project who knows best practices or security principles.

I don’t have the keyboard, but it’s my understanding that application developers can customize the lights on the keyboard. For example if you die in the game your keyboard turns red.

To do that you need IPC, and a JSON endpoint is the most popular form of RPC. If the server listens on localhost, I don’t see any issue with it - any issue you would have with IPC, you would have with this style of of RPC.

Now they could have provided a library to communicate directly with the keyboard - but I think the drawback was games developers didn’t want to integrate it into their games.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#155

Post by sigzero »

javagram wrote: post #96
aphextron wrote: post #78

Earlier quoted context omitted.

>The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app. reply And Windows does? Uninstallers are completely at the behest of application developers. No consumer OS but iOS actually provides any sort of true app level sandboxing.

> And Windows does? Control Panel “add and remove programs” usually works? There’s no equivalent on Mac. Yes, dragging the app to the trash is a thing but that leaves behind content in ~/Library/caches, ~/Library/Application Support, and ~/Library/Preferences . It’s been somewhat of an issue with Mac ever since they first put a hard drive on the original ones back in the 80s... Edit: I literally cleared several GB of…

"add and remove programs" is still relying on the application developer to get it right. I've seen plenty of apps leave behind crap.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#156

Post by oil25 »

kaiwen1 wrote: post #52

Wasn't there once a company with the motto "Don't be evil."? If that motto is abandoned, Apple should claim it since they genuinely try do their best to live by it.

Apple only does so when it's also convenient to their bottom line. They provide the Chinese government backdoor access to iMessage, remove VPN apps from their store to enable censorship, and have we all forgotten they are a PRISM partner? These actions seem pretty "evil" to me.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#157

Post by a13n »

userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

I'm so glad that Apple pushes updates to protect me as a user. Why would I want to be vulnerable to unwanted webcam access?

I am an Apple customer, and I now feel even happier about being one.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#158

Post by Retric »

erikpukinskis wrote: post #136
duncanawoods wrote: post #104

Earlier quoted context omitted.

As nice as that sounds, I think it requires an impossibly perfect prediction of future events. You face ethical decisions whenever you have power or limited resources.

No. You can bend your business model towards transactions you are comfortable with, without perfect future vision, or even a clear strategic understanding of how that might happen. In fact, the world around you will bend to meet your values whether you’re even aware of it. And that includes any companies you run. The world does extend beyond your knowledge of it.

The same forces that require several levels of management make it increasingly difficult to enforce ethical decisions. Basically, when no one person can keep track of all the moving pieces you get splits around what individuals think is acceptable behavior. The larger organizations grows the more things tend to diverge, with different branches often having wildly different perspectives.

This tends to further degrade as new employees are added and any whatever original vision was going on continues to degrade over time. Especially as both the times and even business models change.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#159

Post by judge2020 »

Deimorz wrote: post #69
rawrmaan wrote: post #35

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

I don't think disabling the enterprise certs was particularly moral, Facebook and Google were flagrantly violating the terms of the enterprise program. Apple also apparently didn't even notice (or didn't care) until articles about it started getting a lot of attention. Apple definitely does make some commendable decisions, but I think it's also important to distinguish between bravery and what Ben Thompson calls "Str…

> Apple also apparently didn't even notice

Do they have any information about enterprise apps? As I understand it, Apple never phones home with app info (such as the identifier, name, etc) when verifying or installing enterprise-signed apps, so the only thing they know is probably the IP address requesting to verify the enterprise-signed app and the frequency of how often Apple devices do this certificate verification.

Considering FB and Google have many employees in all different parts of the world, it wouldn't be too suspicious to see a good amount of diversity between GeoIP regions.

Correct me if i'm wrong about what info Apple collects about enterprise apps.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#160

Post by ckuhl »

tonymet wrote: post #44

The bigger question -- what other desktop apps have similar, latent daemons hanging around? I'm always wary of installing stuff like this (e.g. zoom, go2meeting, teamviewer). Anyone know of other sneaky apps to avoid?

I can’t find a reference of the top of my head, but I recall s Logitech mouse(!) also installed a local web server.
Post reply on HN