Who cares?
Apple has pushed a silent Mac update to remove hidden Zoom web server
271–280 of 552 posts
Re: Apple has pushed a silent Mac update to remove hidden Zoom web server
#272Earlier quoted context omitted.
lol they removed what would be called horrific spyware if it wasn’t made by Zoom and you’re over here on some lofty criticism about possible implications years into the future any OS (and many other apps) that update have the power to do what you’re afraid of, and much more. plus i don’t really see a bright line between system level software and an app when apps can access your video cam, mic, all your files - basica…
It's not spyware, this was not something that was intended to be abused, it's insecure software and its very common, you're running plenty of it right now.
> It's not spyware, this was not something that was intended to be abused
Do you have a source for that. It doesn’t peek around my computer a little and/or send back any telemetry? I’m being serious, I’d like to know.
I had to install Zoom in school in 2014, I ended up uninstalling it the next week and reformatted after the quarter. I’m with Apple here. It’s shit insecure non-consenting software that wastes battery 99.99% of the time.
Re: Apple has pushed a silent Mac update to remove hidden Zoom web server
#273Earlier quoted context omitted.
Because macos has no decent concept of package management or containerization.
I mean. The issue at hand was that they purposely left the webserver behind to auto reinstall if a zoom link was clicked. This was an intended feature, and the same could have been done on Linux or Windows. Package management or containers are irrelevant to this conversation.
A package manager would typically have removed the web server, too.
Re: Apple has pushed a silent Mac update to remove hidden Zoom web server
#274Earlier quoted context omitted.
I can't verify since I don't have it installed but I see no reason why this webserver would need root permissions. If it's asking for root it must be for something else.
Quite a few apps ask for root during installation. But now you have me wondering which apps ask for root and which don't. Would be neat if there was a huge app registry website that could show this. Name and shame the ones that ask for root..
Dropbox is one. It always prompts me for my password whenever it launches. I always cancel. It works perfectly without it.
Re: Apple has pushed a silent Mac update to remove hidden Zoom web server
#275That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.
Apple or anyone cannot silently pushing changes to my computer without my explicit consent – especially on unrelated things. What Apple did here is also a dark pattern. We cannot commend them and normalize this behavior. This is a dictatorial one-sided decision by Apple. What else can they do? Can nation state governments compel Apple to push stuff silently? Can this system be abused by hackers? Why are we dependent…
It is enabled by default and if you don’t like that you can disable this behavior.
Re: Apple has pushed a silent Mac update to remove hidden Zoom web server
#276Earlier quoted context omitted.
There is no real sandbox model on Macs if you don’t go through the Mac App Store, only code signing to detect that the app hasn’t been tampered with and to validate the author.
Until Catalina, which will more aggressively use permissions and require all software to be notarized.
Neither statement is true.
There is still the same control-click to open non signed software and there is still no aggressive permission model outside of the App Store.
Re: Apple has pushed a silent Mac update to remove hidden Zoom web server
#277Earlier quoted context omitted.
> /Applications/SomeApp.app/users/taftster/user.specific.data This doesn't work well for a few reasons: - The Unix permission model makes it difficult to set that up in a way that doesn't allow someone to access someone else's user-specific data, or otherwise tamper with the app. - Some setups sync home directories across the network, so everything related to a particular user needs to be under their home directory.…
All these are fair and good points. But all of these are still workable problems that should be very much in the capable hands and constraints of the operating system and "app bundle runner" (call it) to deal with. Your points are all solved by using the user's home directory, very true. But the problem simply remains -- I think this is my main point -- that the "App bundle" has failed the user by not allowing for cl…
For the record, sandboxed macOS apps do exist (as someone mentioned upthread) and have a design somewhat similar to what you're describing, but uglier for the sake of backwards compatibility. For each app you have a directory like /Users/foo/Library/Containers/com.some.bundleid/Data, which is an entire virtualized home directory, containing not just a Library subdirectory but also Desktop, Documents, Downloads, etc. The latter directories shouldn't actually be used, but they're there in case some legacy code tries to access them. When an app presents an open or save dialog, the dialog is out-of-process and unsandboxed, so the user can pick a file from their real home directory or anywhere else; once they do so, the app is automatically granted the ability to access that particular file.
Re: Apple has pushed a silent Mac update to remove hidden Zoom web server
#278Huh? Why is it ok for Apple or anyone to do silent installs on my computer? As a customer, why am I getting this information from YC/Techcrunch and not Apple? What else have they pushed like this? Is there a transparent log? Can we verify if their track record is clean? How many times have they silently broken and fixed their own things? How do we know they won't abuse this? Isn't this the same dark pattern that we c…
Apple has done silent updates for Gatekeeper, the macOS code signing/file quarantine/light anti-malware framework ever since Yosemite. These are done silently unless you explicitly disable all updates and only show up as a visible item when you manually list updates using the softwareupdate command line tool, I think. AFAIK these are just config files and hash databases or similar.
You can view the history of these installs by running softwareupdate --history | grep -E "^MRT|^Gatekeeper"
I see an average of 2 updates per month.
FWIW Apple can also mark something as visible (but install automatically) with a certain config file key. A blog mentions this as being done for patching the NTP bug from a while back:
> Marking these updates as ConfigData cues the App Store to not display these as available software updates in the App Store’s list of software updates. These updates are meant to be under Apple’s control and to be as invisible as possible.
> Meanwhile, an automatically installed software update like OS X NTP Security Update 1.0 shows up as a normal software update, but has extra keys in its catalog listing to mark it as a critical update whose automatic installation is set to occur as soon as possible.
https://derflounder.wordpress.com/2014/12/27/managing-automa...
Re: Apple has pushed a silent Mac update to remove hidden Zoom web server
#279Earlier quoted context omitted.
It does provide a standard way to uninstall an app : drag it to the trash can. I would say that what Zoom did was have their app intentionally install malware that bypassed this normal uninstall. I do think that it would be great to have a more thoroughly sandboxed idea of what an “app” is on the desktop, though.
Snapd, flatpak, appimage all can do this on Linux. Even docker/singularity can sort of do the same for some, if you pass through all the necessary devices and sockets from the host. When you remove the app (or container) all the files it brought with it or created during runtime are now gone. Even the regular Linux package managers like apt, dnf, pacman track which files were installed by which packages, so they can…
The install scripts in rpm/deb can do all sorts of stuff that doesn't get tracked/reversed. There are package linters to help detect some of this buts it's largely a faith based endeavor either way.
Re: Apple has pushed a silent Mac update to remove hidden Zoom web server
#280That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.
I don't think disabling the enterprise certs was particularly moral, Facebook and Google were flagrantly violating the terms of the enterprise program. Apple also apparently didn't even notice (or didn't care) until articles about it started getting a lot of attention. Apple definitely does make some commendable decisions, but I think it's also important to distinguish between bravery and what Ben Thompson calls "Str…
Yeah, I'm not sure I attribute Apple and Tim Cook's latest stances to strong moral fortitude. I think it's more corporate 101:
1) Public sentiment is hammering companies for perceived privacy violations
2) Our business model does not rely heavily on selling user data
3) Make public statements about how much we value privacy at literally no cost to us
4) Get in a good dig at our competition at the same time