Apple has pushed a silent Mac update to remove hidden Zoom web server

> /Applications/SomeApp.app/users/taftster/user.specific.data

This doesn't work well for a few reasons:

- The Unix permission model makes it difficult to set that up in a way that doesn't allow someone to access someone else's user-specific data, or otherwise tamper with the app.

- Some setups sync home directories across the network, so everything related to a particular user needs to be under their home directory. Applications, on the other hand, would be part of the read-only OS image.

- If you delete a user in System Preferences, it gives you the option to delete their data or archive it. This works by deleting or archiving their home directory; things would be much messier if their data were scattered all over the disk.

- It breaks the concept of an app bundle as a immutable, sealed tree that can have its validity checked via code signature.

- If you're searching through your disk to see what's using up disk space, mingling user data with the app itself makes it harder to distinguish between the two.

- If the app decides to start storing its data in iCloud and syncing it across devices, it wouldn't make any sense to have it within the app bundle: among other things, you don't want the app's immutable data (i.e. what's in the app bundle today) to count towards your storage quota, and the data may be shared between, e.g., the macOS and iOS version of an app. (Application Support itself is not synced to iCloud, though.)

> And when the "global" application gets deleted, I most definitely want all the user data deleted with it as well.

Do you?

- What if you're just upgrading the app? If you download a new app bundle, drag it into Applications, and tell Finder to overwrite, it will delete everything in the old bundle.

- What if you're migrating to a new Mac? You may prefer to reinstall applications manually instead of copying everything, but that doesn't mean you want to lose your data.

- Even if you do want to delete the app entirely, does that actually mean you want to lose your data from that app? What if you're planning on reinstalling it in the future? iOS does automatically delete data when deleting an app, but it's not at all obvious to me that that's the best behavior.

No, on OS X there is literally no reason to move anything from out of your application bundle. Copying the server out of the application bundle had one effect: it makes removing the app not remove the server.

There are apis to register for launch, there are launch service plists, etc which all correctly, and by default handle the user deleting your app bundle.

There are already “cryptographic mechanisms to detect modification of your app”, it’s the platform code signing mechanism, and Xcode will produced signed binaries by default.

Finally, your post comes across as saying that you believe leaving the server was unintentional due to lack of APIs (ignoring that removing an application is a sign that the user doesn’t want your app to run any code). Their “unintentionally” persistent server explicitly check for the app being removed, and if it had been, would redownload it and install it without user consent.

Wild speculation.

I do appreciate Apple's overall stance and actions regarding privacy, but I see this as a very practical action for their own self-interest. Apple has staked its reputation on privacy. The headline-level summary of this incident is that Mac users are exclusively affected by Zoom's bug/security hole. Among consumers, unauthorized access to the webcam is the epitome of modern invasion of privacy. All it takes is one Apple user to be victimized for Apple's reputation on privacy to be as much of an ongoing punchline as Samsung's exploding phones.

No wonder Apple took this step!

Many users are unable to enable Video feature even after applying recent patch released by Zoom. Also zoom has become security joke/conversation topic while starting a con calls!