Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

251–260 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#251

Post by olliej »

javagram wrote: post #98
fastball wrote: post #88

Earlier quoted context omitted.

I think that is the point. MacOS users expect an app that does not come bundled with an uninstaller to be "uninstalled" by dragging the .app bundle to the trash. This generally leaves behind metadata, but that is not a big deal as it is just data - not code. Leaving behind code that continues to execute after the user has removed the application without an option to uninstall it is obviously something that never shou…

FWIW I am not sure how dragging the .app to the trash would uninstall other things installed by the app. If I drag photoshop to my trash instead of using Adobe’s uninstaller, I’m pretty sure that leaves Creative Cloud junk running on my machine. Now, zoom did mess up by not having a proper uninstaller shipped with their app, I think a lot of other Mac apps do fail at this too though.

The server was deliberately left running: if it was unintentional it would just error out if Zoom had been removed. Instead it downloaded and installed the client again. That’s fairly clearly designed to override the user’s attempt to remove the software, and is exactly the kind of thing malware does.

There is a real problem many (often primarily windows) apps have this bizarre desire to “install” content randomly scattershot across the OS. There is no reason to do this on Mac OS. OS X happily supports multiple binaries and services per bundle.

If you write an app that needs an uninstaller on OS X, and you aren’t needing to install some kind of driver, your app is doing things it should not be doing, and does not even need to do.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#252

Post by dboreham »

devin wrote: post #245
m0dest wrote: post #42

This means there might have been another side to this story: Zoom's change of heart might have been forced by Apple, not the public backlash. Apple: Hey, your app poses a threat to macOS security. We're going to remove your server app with the built-in macOS anti-virus. Zoom: Oh crap. Okay, give us 2 sprints to release a new version that removes it. Apple: We're killing it in 48 hours. ... Zoom, after an all-nighter:…

Wild speculation.

But highly plausible.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#253

Post by Twisell »

taftster wrote: post #216
taftster wrote: post #211

Earlier quoted context omitted.

Thanks for the reply, really good stuff. But what I don't get, why even have an "Application Support" directory at all. There is absolutely nothing of value added to me (as a user) to have files stored there. It's just one more place I have to look to clean up after an application is deleted. So dumb and adds zero value. I'll put my files into Documents (or whatever). And you (as an application developer) put your fi…

[self-reply, sorry] For example, Steam games stored in Application Support. Why?? If I install a game from Steam, it should be installed somewhere in the Steam app bundle. When I delete the Steam app, I delete everything related. So dumb.

Yeah but this is clearly a special case as Steam is not AppStore distributable AND it is basically an alternative to the AppStore.

They clearly could have made other choices and they have their own logic, but that clearly not on Apple role to oversight how their concurrents operate.

Antitrust, geeks and media network would instantly gather pitchforks to run on Apple if they even dare to hypothetically mention it.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#254

Post by taftster »

comex wrote: post #241
taftster wrote: post #231

Earlier quoted context omitted.

You're saying that an application can't write user specific information into the bundle and sort that out? There's no difference between these two (hypothetical) file paths: /Applications/SomeApp.app/users/taftster/user.specific.data /Users/taftster/Library/Application Support/SomeApp/user.specific.data These two file paths are effectively the same. And when the "global" application gets deleted, I most definitely wa…

> /Applications/SomeApp.app/users/taftster/user.specific.data This doesn't work well for a few reasons: - The Unix permission model makes it difficult to set that up in a way that doesn't allow someone to access someone else's user-specific data, or otherwise tamper with the app. - Some setups sync home directories across the network, so everything related to a particular user needs to be under their home directory.…

All these are fair and good points. But all of these are still workable problems that should be very much in the capable hands and constraints of the operating system and "app bundle runner" (call it) to deal with.

Your points are all solved by using the user's home directory, very true. But the problem simply remains -- I think this is my main point -- that the "App bundle" has failed the user by not allowing for cleanup of everything that the application has created. If an application can simply write any executable into any user directory it wants, there's no code signing or integrity checks on the app itself that matters.

Applications should be treated as hostile, just like a user is treated in a multi-user system.

I think it's a failure of an operating system to not be completely in control of the limitations and installation of any program. It's also a failure of the developer community to not stand up and insist on this too. A sand-boxed model is what we should all be striving for here. Force the bad actors out.

I'm not a Mac developer (obviously). But I am an old Unix neckbeard. So I get all of your points; Unix invented this problem.

In a multiuser system, individual users are treated as hostile. Going forward, so too should applications. That's the failure in all of this (and it's been with us a long time now). Our security model is based on not trusting users, but in trusting applications. This thinking was born in the 60's when users couldn't install/execute any random download.

It's interesting that the unix model of security is hurting us more today than helping. The time for sandboxed applications is definitely overdue.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#255

Post by jtbayly »

scarface74 wrote: post #209
javagram wrote: post #201

Earlier quoted context omitted.

OK but on Mac, dragging the app to the trash doesn’t launch an uninstall process, so it will always leave the crap behind.

Your app is suppose to be self contained....

Then what in the world is the huge Application Support folder for?

And why is it filled with stuff from Apple programs?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#256

Post by jtbayly »

taftster wrote: post #228
moduspol wrote: post #218

Earlier quoted context omitted.

> But what I don't get, why even have an "Application Support" directory at all. The bundle isn't normally writeable by the app itself. It's generally good security practice to not have your app capable of rewriting what itself can do, and iOS is the same way. You can't write into your app bundle, so anything at all that you want to persist needs to go somewhere else (typically in "Application Support"). That would i…

Again, good reply thank you. Just to continue a little more... > The bundle isn't normally writeable by the app itself. It's generally good security practice to not have your app capable of rewriting what itself can do, and iOS is the same way. You can't write into your app bundle, so anything at all that you want to persist needs to go somewhere else (typically in "Application Support"). I don't buy this. If you are…

Ok, but an SQLite dB isn’t an executable. So what should an app do with that?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#257

Post by eeeeeeeeeeeee »

userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

This sort of mentality means that nontechnical users will never be protected. Someone needs to take an active role in security and this kind of action is part of it. If the app developer is skirting the issue, Apple should be the company to step up. Who else will solve an issue on this scale? The developer should have stepped up and fixed it; instead they chose to dismiss it.

Apple made the right call for this instance, especially after the completely insufficient excuses given by Zoom’s CIO.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#258

Post by unsatchmo »

xoa wrote: post #168
sjwright wrote: post #122

Earlier quoted context omitted.

I’m sure Apple is as upset as anyone else. It effectively breaks their sandbox model so they’ll probably be working hard on a way to plug that hole gracefully.

> It effectively breaks their sandbox model The sandbox only applies to software devs that want to use it or those that wish to sell through the Mac App Store. I don't think Zoom is in the MAS at all (I don't see it in a quick search anyway), and a standalone installer is free to do whatever it wants and can convince users to go along with (up to and including, in principle, bypassing SIP though since that significan…

SIP cannot be disabled by anything running in the current boot session. Once the root volume is mounted, the SIP flags are set in the mountpoint. The root volume obviously cannot be unmounted while it is booted from.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#259

Post by eeeeeeeeeeeee »

jbverschoor wrote: post #213
userbinator wrote: post #173

Earlier quoted context omitted.

any OS (and many other apps) that update have the power to do what you’re afraid of, and much more. There's an ocean of difference between can and will . plus i don’t really see a bright line between system level software and an app when apps can access your video cam, mic, all your files - basically your whole computer. The setting ostensibly refers to the operating system , i.e. macOS, which I have no problems with…

I’m quite happy with it, as I don’t see millions of people removing some hidden directory. No more zoom for me.

Exactly. What is the other option? Show my mom how to use terminal to delete hidden dot directories?

I also purged Zoom. They’ve blown it in the trust department. They better start working on a web app because that is as much access they’ll get from me in the future.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#260

Post by BlueGh0st »

filmgirlcw wrote: post #150
userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

There are reports there was another RCE that Zoom didn’t/wouldn’t fix. This is what Gatekeeper and the built-in anti-malware engine is suppose to do — remove malware. If you don’t want this feature, you can turn it off, but this is a sane default and a good thing. Apple didn’t flex anything here, it removed malware from its users computers. https://twitter.com/riskybusiness/status/1148824808236318721

If "malware" is going to include any software with security bugs, then Gatekeeper should just rm -rf the whole drive.
Post reply on HN