Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

171–180 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#171

Post by cush »

userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

They worked with Zoom to kill the zombie servers which were left behind after Zoom is uninstalled. Not really flexing. Zoom accidentally created malware, and Apple killed it using the same mechanisms they would to kill other malware.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#172

Post by elliekelly »

0xADEADBEE wrote: post #92
rawrmaan wrote: post #35

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

I would be reticent to praise them quite so effusively, though I do think they're the best of of the big tech companies currently. I'll be watching the development of this suit with great interest: https://time.com/5596033/lawsuit-apple-selling-itunes-listen...

I think that case is kind of a stretch. I read the complaint and there are two arguments:

1. Lists of people who have purchased [music genre] from iTunes & listened on Pandora is for sale by data brokers, and

2. App developers (they specifically call out Pandora) who use the MediaFramework API have access to iTunes library metadata that they can then collect.

I haven’t looked at Apple’s Developer Agreement recently but I suspect Pandora (and potentially others) hasn’t complied with the terms.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#173

Post by userbinator »

zaptheimpaler wrote: post #121
userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

lol they removed what would be called horrific spyware if it wasn’t made by Zoom and you’re over here on some lofty criticism about possible implications years into the future any OS (and many other apps) that update have the power to do what you’re afraid of, and much more. plus i don’t really see a bright line between system level software and an app when apps can access your video cam, mic, all your files - basica…

any OS (and many other apps) that update have the power to do what you’re afraid of, and much more.

There's an ocean of difference between can and will.

plus i don’t really see a bright line between system level software and an app when apps can access your video cam, mic, all your files - basically your whole computer.

The setting ostensibly refers to the operating system, i.e. macOS, which I have no problems with Apple modifying if you've enabled that option, and which their EULA probably has a clause about. But from a legal perspective, modifying a third-party application which Apple does not own and did not install seems an overreach; unless their EULA explicitly grants them the right to do anything they want with the files of the system it's installed on, they could find themselves in legal trouble. (That notorious CFAA and the like.)

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#174

Post by askafriend »

userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

> but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install.

I love this. This is why I'll keep buying Apple.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#175

Post by outworlder »

kevingadd wrote: post #90
outworlder wrote: post #79

Earlier quoted context omitted.

Nor does Windows for that matter. Running installshield with some command line parameter doesn't count. Linux package managers come close, but not all third party apps are installed like that.

Having a standard installer toolkit that comes with the os and used by many os updates along with a centralized uninstall UI is nothing?

> Having a standard installer toolkit that comes with the os and used by many os updates along with a centralized uninstall UI is nothing?

If we are talking about OS updates, OSX has the same thing.

You are not required to use Windows Installer. And even if you do, you are not guaranteed that everything will be removed, be it due to malice or incompetence.

Not even Linux can guarantee that. Something like the Nix package manager would be closer to what's required. Plus a sandbox.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#176

Post by ummonk »

mdellavo wrote: post #125
drevil-v2 wrote: post #23

I wonder what happens now to the Product Owner who decided it was OK to install hidden web server on user machines?

eng has responsibility here for going forward with this

This was likely a product manager decision, implemented by some hapless kid fresh out of college.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#177

Post by mortenjorck »

sjwright wrote: post #122
rrix2 wrote: post #103

Earlier quoted context omitted.

It bothers me that people weren't more upset about this part.

I’m sure Apple is as upset as anyone else. It effectively breaks their sandbox model so they’ll probably be working hard on a way to plug that hole gracefully.

I would not be surprised at all if this episode has some concrete ramifications in 10.15. It could take the shape of something akin to iOS’ location permissions for applications that want to run a server, or even a first-party framework for accomplishing the thing Zoom was trying to do, but it’s probably safe to say what Zoom was doing won’t be possible next year.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#178

Post by _rs »

vondur wrote: post #13

If you would like to force this update you can do so via the terminal: softwareupdate -ia --include-config-data It will show up as MRTConfigData if you look under Apple Menu->About This Mac->System Report->Software->Installations. The latest version is 1.45 and was updated today which includes the Zoom mitigations.

Any details about --include-config-data? Doesn't seem to be documented in the help message.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#180

Post by xenadu02 »

oil25 wrote: post #156
kaiwen1 wrote: post #52

Wasn't there once a company with the motto "Don't be evil."? If that motto is abandoned, Apple should claim it since they genuinely try do their best to live by it.

Apple only does so when it's also convenient to their bottom line. They provide the Chinese government backdoor access to iMessage, remove VPN apps from their store to enable censorship, and have we all forgotten they are a PRISM partner? These actions seem pretty "evil" to me.

> They provide the Chinese government backdoor access to iMessage

No. What gave you this idea? iMessage is end-to-end encrypted. The keys are managed by the devices themselves. There is no facility to backdoor or intercept the messages.

Apple acts as a registration server, notifying your devices when a new device signed in as you joins the pool but the devices themselves tell you when this has happened. That’s all client-side. If the server didn’t tell the client about a new peer it would never encrypt a copy of the message for that peer and that peer wouldn’t get the messages.

Post reply on HN