Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

201–210 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#201

Post by javagram »

scarface74 wrote: post #195
javagram wrote: post #96

Earlier quoted context omitted.

> And Windows does? Control Panel “add and remove programs” usually works? There’s no equivalent on Mac. Yes, dragging the app to the trash is a thing but that leaves behind content in ~/Library/caches, ~/Library/Application Support, and ~/Library/Preferences . It’s been somewhat of an issue with Mac ever since they first put a hard drive on the original ones back in the 80s... Edit: I literally cleared several GB of…

Control Panel “add and remove programs” usually works? All that does is launch the app’s uninstall process. The app is free to leave whatever crap it wants to on your system.

OK but on Mac, dragging the app to the trash doesn’t launch an uninstall process, so it will always leave the crap behind.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#202

Post by AlexandrB »

evv wrote: post #139
awinder wrote: post #97

Earlier quoted context omitted.

I don’t understand how a “you’re about to jump out of the app” confirm panel is breaking protocol links. I actually want this behavior for zoom and any other app...

The first time you use that protocol, of course a warning is appropriate. To prompt the user on _every_ external protocol click seems.. hostile to the concept of linking

It needs to happen at least for every combination of source domain and protocol. Otherwise websites can drive-by open zoom, reminders, or whatever other app you have installed to achieve some marketing or malware goal (or just DoS your computer).

Edit: Once you consider social sites with user-submitted content, like reddit, it might be best if you’re prompted every time.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#203

Post by javagram »

fastball wrote: post #130
javagram wrote: post #98

Earlier quoted context omitted.

FWIW I am not sure how dragging the .app to the trash would uninstall other things installed by the app. If I drag photoshop to my trash instead of using Adobe’s uninstaller, I’m pretty sure that leaves Creative Cloud junk running on my machine. Now, zoom did mess up by not having a proper uninstaller shipped with their app, I think a lot of other Mac apps do fail at this too though.

Yes, as is, dragging apps to the trash cannot do that. Apple should probably implement an API that allows developers to tell the OS what other stuff should be removed if the app is dragged to the trash. To prevent devs from removing other people's stuff, you could require that the subcomponents need to be cryptographically signed with the same key as the main app bundle. edit: or, even simpler solution (potentially)…

I think your edit is describing a package manager :D Or the Mac App Store... (But yes, it would be good if this feature were available for apps that can’t come through the App Store)

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#204

Post by comex »

fastball wrote: post #130
javagram wrote: post #98

Earlier quoted context omitted.

FWIW I am not sure how dragging the .app to the trash would uninstall other things installed by the app. If I drag photoshop to my trash instead of using Adobe’s uninstaller, I’m pretty sure that leaves Creative Cloud junk running on my machine. Now, zoom did mess up by not having a proper uninstaller shipped with their app, I think a lot of other Mac apps do fail at this too though.

Yes, as is, dragging apps to the trash cannot do that. Apple should probably implement an API that allows developers to tell the OS what other stuff should be removed if the app is dragged to the trash. To prevent devs from removing other people's stuff, you could require that the subcomponents need to be cryptographically signed with the same key as the main app bundle. edit: or, even simpler solution (potentially)…

The real solution is to not install anything outside of your app bundle in the first place. In this case, instead of sticking a plist in ~/Library/LaunchAgents, you can use an API to add a login item, pointing to a helper .app inside the main app bundle:

https://developer.apple.com/library/archive/documentation/Ma...

Then the system will automatically disable the login item if the app is removed.

Edit: It seems like Zoom was using a login item, but using the "shared file list" API instead of the newer (but still dating back to 10.6) SMLoginItemSetEnabled.

An alternative is to just make your daemon check for itself whether the main app has been removed, and delete itself if so.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#205

Post by scarface74 »

vbezhenar wrote: post #170
scarface74 wrote: post #91

Earlier quoted context omitted.

Intent doesn’t matter only results. The result is that unless you like for random websites to be able to activate your camera without your permission, it did harm users. It wasn’t a “bug”. They purposefully hacked around a security feature. Do you really think it was a “bug” that it reinstalled itself?

> Intent doesn’t matter only results. Then you should call Chrome a malware because there were vulnerabilities with remote code execution (and there will be similar vulnerabilities), so every website could install anything. But that is absurd. > The result is that unless you like for random websites to be able to activate your camera without your permission, it did harm users. First of all, you need a hard data that…

First of all, you need a hard data that this vulnerability was exploited in the wild

So would it also be okay for a credit bureau to post all of your information to a website? Would that be okay until it was “exploited in the wild”?

Are you really saying it’s okay to run knowingly insecure software until there are reports of it being exploited?

Only a few years ago every browser supported Java Applets and with Java Applets every website could run arbitrary code on your machine.

Java applets ran in a sandbox.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#206

Post by oil25 »

xenadu02 wrote: post #180
oil25 wrote: post #156

Earlier quoted context omitted.

Apple only does so when it's also convenient to their bottom line. They provide the Chinese government backdoor access to iMessage, remove VPN apps from their store to enable censorship, and have we all forgotten they are a PRISM partner? These actions seem pretty "evil" to me.

> They provide the Chinese government backdoor access to iMessage No. What gave you this idea? iMessage is end-to-end encrypted. The keys are managed by the devices themselves. There is no facility to backdoor or intercept the messages. Apple acts as a registration server, notifying your devices when a new device signed in as you joins the pool but the devices themselves tell you when this has happened. That’s all cl…

> iMessage is end-to-end encrypted. The keys are managed by the devices themselves. There is no facility to backdoor or intercept the messages.

That is only a half-truth. Apple controls the key infrastructure; they may replace your keys with arbitrary ones at the demand, coercion or compromise by any number of bad actors. The software is closed source, making it impossible to verify any actual claims made otherwise. If they truly valued privacy, why not open source iMessage, allow users to verify iMessage keys, hire an independent third party to audit their infrastructure, or all of the above?

Moreover, Apple has moved iCloud infrastructure to Chinese data centers to enable spying on millions of innocent people. They have removed apps from their store which circumvent Chinese censorship. These are truly shameful acts which has appropriately drawn criticism from human rights watch organizations.

https://techcrunch.com/2018/02/25/apple-moves-icloud-encrypt...

https://www.cnbc.com/2018/02/24/apple-moves-to-store-icloud-...

https://www.nytimes.com/2017/07/29/technology/china-apple-ce...

https://blog.cryptographyengineering.com/2013/06/26/can-appl...

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#207

Post by hunter2_ »

vbezhenar wrote: post #71
scarface74 wrote: post #62

Earlier quoted context omitted.

A program that surreptitiously reinstalls software when you uninstall it is by definition malware. A piece of software that lets any website activate your camera without your permission is a security vulnerability.

Malware is a software written to harm user. Their purpose was not to harm user, they wanted to make their service more convenient for users. Bugs are bugs, every product have bugs and many products have security bugs. That does not make them malware.

There is tons of malware that doesn't harm the user. Take crypto mining for example: it raises the temperature and the electricity bill, but those things aren't per se harmful (albeit financially). Or how about a botnet client that harms some other entity but not the user who owns the machine it's on? Or adware? The list goes on and on... calling this nefarious behavior "harm" is a huge stretch but calling it "malware" is not.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#208

Post by duncanawoods »

wwright wrote: post #127
duncanawoods wrote: post #104

Earlier quoted context omitted.

As nice as that sounds, I think it requires an impossibly perfect prediction of future events. You face ethical decisions whenever you have power or limited resources.

Yeah, I agree, but I think that is just a way of stating that morals are impossible to perfect.

Hmm maybe - what I have in mind is that you could run something undeniably good e.g. a hospital, and you will still face hard ethical decisions about how you handle uncertainty, apply power or allocate your resources. Doing good things just isn’t easy!

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#209

Post by scarface74 »

javagram wrote: post #201
scarface74 wrote: post #195

Earlier quoted context omitted.

Control Panel “add and remove programs” usually works? All that does is launch the app’s uninstall process. The app is free to leave whatever crap it wants to on your system.

OK but on Mac, dragging the app to the trash doesn’t launch an uninstall process, so it will always leave the crap behind.

Your app is suppose to be self contained....

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#210

Post by bin0 »

vbezhenar wrote: post #27
bredren wrote: post #6

Earlier quoted context omitted.

So the local server is not a regular price of software with a vulnerability, it is now considered malware?

That's Apple's closed garden, even when they allow you to sideload application, they still have the ultimate decision. Of course it's not malware, but probably enough users have vulnerable software which could be remotely exploited, that they decided to blacklist it.

Microsoft could do the same with Windows Defender with jutification, had the windows version exhibited the same malicious behavior.
Post reply on HN