Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

211–220 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#211

Post by taftster »

moduspol wrote: post #169
taftster wrote: post #126

Earlier quoted context omitted.

Which is completely frustrating, because Mac is totally in the position of using its built-in capabilities to deal with this. The Mac Bundle (.app) format could solve this entirely. All application specific data should be written inside of the bundle folder, so that when you delete the app, you delete the thing entirely. I mean, maybe you need a "user data" bundle of sorts tied to the specific application. If you del…

As a Mac app developer, you mostly have to go out of your way to install things[1] outside of the app bundle, and you typically don't want to because that's only extra maintenance you have to do to update / version those files. Most apps don't, and that's why most apps actually are effectively removed when you drag the bundle into the trash. There is already a concept of a "user data" directory for the app, which is…

Thanks for the reply, really good stuff.

But what I don't get, why even have an "Application Support" directory at all. There is absolutely nothing of value added to me (as a user) to have files stored there. It's just one more place I have to look to clean up after an application is deleted. So dumb and adds zero value.

I'll put my files into Documents (or whatever). And you (as an application developer) put your files in your app bundle directory. That should be the contract for most (all?) user space applications.

I agree my prompt idea is generally poor and wouldn't work, it was mostly just for discussion purposes. But the mechanics of a fix for this are in place, rogue daemons that can't be deleted are just unacceptable.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#212

Post by johnhart »

hunter2_ wrote: post #184
lonelappde wrote: post #131

Earlier quoted context omitted.

Removing a malware app is installing a system security update.

Would you happen to have any examples outside of this particular update where an OS security update goes and changes something that the OS didn't itself create? Genuinely curious if this is a thing. The word "system" can be scoped any which way (see system of systems) but typically means "part of the OS" in this context.

Microsoft does this monthly with the Malicious Software Removal Tool which comes down as part of Windows Update.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#213

Post by jbverschoor »

userbinator wrote: post #173
zaptheimpaler wrote: post #121

Earlier quoted context omitted.

lol they removed what would be called horrific spyware if it wasn’t made by Zoom and you’re over here on some lofty criticism about possible implications years into the future any OS (and many other apps) that update have the power to do what you’re afraid of, and much more. plus i don’t really see a bright line between system level software and an app when apps can access your video cam, mic, all your files - basica…

any OS (and many other apps) that update have the power to do what you’re afraid of, and much more. There's an ocean of difference between can and will . plus i don’t really see a bright line between system level software and an app when apps can access your video cam, mic, all your files - basically your whole computer. The setting ostensibly refers to the operating system , i.e. macOS, which I have no problems with…

I’m quite happy with it, as I don’t see millions of people removing some hidden directory.

No more zoom for me.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#215

Post by oil25 »

userbinator wrote: post #182
oil25 wrote: post #167

Earlier quoted context omitted.

Well said. Apple loves to flex muscle as a show of force - virtue signaling - when there is some great drama going on. It is terrifying to know they have covert remote root code execution on Macs and iPhones at all times, which they may use without your consent of even knowledge. To me, that is a greater security risk and the reason I will not use their products in favor of open source operating systems only. It sadd…

The RCE is a given for anything that has automatic updates enabled, and IMHO isn't really the focus of this issue; the main concern is with the scope of what they are allowed to "update", and the legal ramifications thereof. Yes, Apple does have the power to change every bit on your hard disk if you let it. Things like EULAs are supposed to govern to what extent they can use that power.

> Yes, Apple does have the power to change every bit on your hard disk if you let it. Things like EULAs are supposed to govern to what extent they can use that power.

Please help me understand this. Where in the EULA or elsewhere have users allowed Apple to remotely install a U2 album, or delete third-party software? What of the fact the EULA itself can change at any time without any posted notice? Or worse, what if Apple is forced or breached to deliver a "security update" which steals personal information or bricks your device? Why is this not a legitimate concern to technical professionals? Or, where is the documentation which at least explains this behavior to put curious minds at ease?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#216

Post by taftster »

taftster wrote: post #211
moduspol wrote: post #169

Earlier quoted context omitted.

As a Mac app developer, you mostly have to go out of your way to install things[1] outside of the app bundle, and you typically don't want to because that's only extra maintenance you have to do to update / version those files. Most apps don't, and that's why most apps actually are effectively removed when you drag the bundle into the trash. There is already a concept of a "user data" directory for the app, which is…

Thanks for the reply, really good stuff. But what I don't get, why even have an "Application Support" directory at all. There is absolutely nothing of value added to me (as a user) to have files stored there. It's just one more place I have to look to clean up after an application is deleted. So dumb and adds zero value. I'll put my files into Documents (or whatever). And you (as an application developer) put your fi…

[self-reply, sorry]

For example, Steam games stored in Application Support. Why?? If I install a game from Steam, it should be installed somewhere in the Steam app bundle. When I delete the Steam app, I delete everything related. So dumb.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#218

Post by moduspol »

taftster wrote: post #211
moduspol wrote: post #169

Earlier quoted context omitted.

As a Mac app developer, you mostly have to go out of your way to install things[1] outside of the app bundle, and you typically don't want to because that's only extra maintenance you have to do to update / version those files. Most apps don't, and that's why most apps actually are effectively removed when you drag the bundle into the trash. There is already a concept of a "user data" directory for the app, which is…

Thanks for the reply, really good stuff. But what I don't get, why even have an "Application Support" directory at all. There is absolutely nothing of value added to me (as a user) to have files stored there. It's just one more place I have to look to clean up after an application is deleted. So dumb and adds zero value. I'll put my files into Documents (or whatever). And you (as an application developer) put your fi…

> But what I don't get, why even have an "Application Support" directory at all.

The bundle isn't normally writeable by the app itself. It's generally good security practice to not have your app capable of rewriting what itself can do, and iOS is the same way. You can't write into your app bundle, so anything at all that you want to persist needs to go somewhere else (typically in "Application Support").

That would include mostly anything the app persists to disk that the user didn't explicitly choose, like an sqlite database or something.

> But the mechanics of a fix for this are in place, rogue daemons that can't be deleted are just unacceptable.

I see where you're coming from, but I think this is really the only balance Apple can strike here. That balance is essentially that non-App Store apps/installers are not sandboxed and can mostly do whatever they want, but Apple can step in with X-Protect (like they did here) and remove anything egregious.

They've also moved forward recently with the concept of notarizing, which will still allow apps/installers to do whatever they want, but they'll at least need to be validly signed by a verifiable private key that Apple can then revoke if you (as the developer who signed things with it) do anything egregious.

Again--it seems unreasonable in this case, but there are undoubtedly numerous very popular unsandboxed Mac apps that do sketchier things for more valid use cases. Any prompts or restrictions are going to be very disruptive and prompt a new wave of blog and HN posts about Apple trying to kill app distribution outside the App Stores.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#219

Post by arthurfm »

javagram wrote: post #96
aphextron wrote: post #78

Earlier quoted context omitted.

>The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app. reply And Windows does? Uninstallers are completely at the behest of application developers. No consumer OS but iOS actually provides any sort of true app level sandboxing.

> And Windows does? Control Panel “add and remove programs” usually works? There’s no equivalent on Mac. Yes, dragging the app to the trash is a thing but that leaves behind content in ~/Library/caches, ~/Library/Application Support, and ~/Library/Preferences . It’s been somewhat of an issue with Mac ever since they first put a hard drive on the original ones back in the 80s... Edit: I literally cleared several GB of…

> OmniDiskSweeper is great for finding this stuff.

iTrash [1] is also worth mentioning. It uses the Levenshtein distance algorithm [2] to find all of the junk related to an app.

[1] http://www.osxbytes.com

[2] https://en.wikipedia.org/wiki/Levenshtein_distance

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#220

Post by acolumb »

rawrmaan wrote: post #35

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

Never forget PRISM.
Post reply on HN