Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

291–300 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#291

Earlier quoted context omitted.

> And Windows does? Control Panel “add and remove programs” usually works? There’s no equivalent on Mac. Yes, dragging the app to the trash is a thing but that leaves behind content in ~/Library/caches, ~/Library/Application Support, and ~/Library/Preferences . It’s been somewhat of an issue with Mac ever since they first put a hard drive on the original ones back in the 80s... Edit: I literally cleared several GB of…

Have you checked ProgramData, Local, and Roaming recently? Or your registry? Also, Add/Remove only works if the program adds itself there. And remove only works if the program added an uninstaller. Also, even then, it still leaves crap behind.

At least there is a convention to have an uninstaller. If you create the installer through conventional toolboxes the uninstaller comes for free. That's how most Windows programs have both.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#292
Does anyone know if issues like this would only affect the current user account?

I currently have a separate limited user account just for meetings, and that’s where I install various meeting apps. So in my case is there any way to know if Zoom or WebEx would install stuff on all accounts?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#293
post #222

Earlier quoted context omitted.

Mac OS is a multi-user operating system. Most applications that are installed are global to the system although each user also has their own Applications folder. The Application Support folder resides in the user's Library folder and contains information that the app needs when running for that particular user. Storing information in the .app bundle would affect every user on that computer.

You're saying that an application can't write user specific information into the bundle and sort that out? There's no difference between these two (hypothetical) file paths: /Applications/SomeApp.app/users/taftster/user.specific.data /Users/taftster/Library/Application Support/SomeApp/user.specific.data These two file paths are effectively the same. And when the "global" application gets deleted, I most definitely wa…

You're trading one problem for another. What if I want to delete a user instead? Now I have that user's crap in every application bundle.

However, the OS should perhaps insist on a particular location within "Application Support/" that each app can write to, and when the application bundle is deleted, provide a way to delete those support files as well, either for that user alone or for all users within permission (can be a system-wide configuration).

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#294
post #44

The bigger question -- what other desktop apps have similar, latent daemons hanging around? I'm always wary of installing stuff like this (e.g. zoom, go2meeting, teamviewer). Anyone know of other sneaky apps to avoid?

Most devs of most OS X desktop apps are convinced their junk is important enough to pollute LaunchAgents with and none ask for permission. Be a "normal" user, install software you think is useful and you'll end up running a hosting service for a thousand "latent" daemons and "helper" programs.

Not as serious as leaving an httpd around and then letting sites to hot mic you with it -- obviously -- but on par in terms of a few select adjectives.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#295

Earlier quoted context omitted.

As a Mac app developer, you mostly have to go out of your way to install things[1] outside of the app bundle, and you typically don't want to because that's only extra maintenance you have to do to update / version those files. Most apps don't, and that's why most apps actually are effectively removed when you drag the bundle into the trash. There is already a concept of a "user data" directory for the app, which is…

Thanks for the reply, really good stuff. But what I don't get, why even have an "Application Support" directory at all. There is absolutely nothing of value added to me (as a user) to have files stored there. It's just one more place I have to look to clean up after an application is deleted. So dumb and adds zero value. I'll put my files into Documents (or whatever). And you (as an application developer) put your fi…

True, for many uses it would be cleaner to write application data to the bundle, even though this isn't commonly writeable. As someone who develops professional apps for Mac, I can thin of a few circumstances where this definitely won't work, or at least will introduce other compromises or require a whole lot of extra effort of developers and/or users.

- You want to uninstall/re-install an app without removing the application's data - The application's data can become large (think raw audio or video libraries) and users request to store it in a separate disk - Users want to personally organize the data they make with your app (by project, client, personal/work, etc.), or use it with other apps - Your "installer" is just a zip of the .app bundle and there is no obvious opportunity to assume admin privileges make the bundle writeable

Most of these could be solved by having a separate "sandbox" a la iOS or MAS that can be moved or, at the user's option, remain on disk when uninstalling; as far as I know neither system offers these capabilities.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#296
post #267
post #168

Earlier quoted context omitted.

> It effectively breaks their sandbox model The sandbox only applies to software devs that want to use it or those that wish to sell through the Mac App Store. I don't think Zoom is in the MAS at all (I don't see it in a quick search anyway), and a standalone installer is free to do whatever it wants and can convince users to go along with (up to and including, in principle, bypassing SIP though since that significan…

Not after Catalina. Future versions of macOS will require signed software (notarized as per Apple terminology), even outside of the store. What is new in security at WWDC.

Signed is not the same to Sandboxed on macOS, afaik.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#297

Earlier quoted context omitted.

> all the files it brought with it or created during runtime are now gone. How would this work with apps that create things that a user would expect to persist, like downloads (kept after uninstalling a browser) or office documents (kept after uninstalling the office suite), or media production apps, IDEs, etc.? It could have some rule like "let it be if it's in the user home directory" or "only remove stuff in these…

Such a system would not allow the application to write to any place outside of its sandbox or a designated user document volume. The system can't be touched. If you want to create a system config file, you are responsible to break the glass and move it and then all bets are off.

I can imagine an allowance to "break the glass" within the context of the app so long as the app invokes an obvious-to-the-user common dialog (like the typical file>save / file>open / choose-a-folder), but there would be no "breaking the glass" in an invisible / programmatic manner. That sounds quite nice.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#298
This is why I don’t trust apps outside the App Store as much.

If we can’t trust an app that is the cornerstone of a 25 billion dollar business (Zoom’s market cap) not to install malware, then I don’t know.

I want the trust through the App Store.

PS. I love Zoom, and find it to be the best conference solution out there.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#299
post #269

Earlier quoted context omitted.

Until Catalina, which will more aggressively use permissions and require all software to be notarized.

Neither statement is true. There is still the same control-click to open non signed software and there is still no aggressive permission model outside of the App Store.

There is, but even the control click will only allow you to open signed software. Unless you build the software yourself (I'm not sure how homebrew still works) you cannot run it if it's not been notarized by Apple.

Firefox was broken on Catalina for a while, even though the main app was notarized. Some internal binary wasn't notarized, and no amount of control clicking would get Firefox to work until Mozilla notarized everything in the build.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#300
post #234

Has anyone checked that `dpkg --purge zoom` does the right thing, on debian/ubuntu?

Keep in mind dpkg never removes user data. So that said, I checked, and it removes everything zoom installs that isn't in a user directory, plus (there is an extra script that does this): remove_folder "/opt/zoom" remove_folder "$HOME/.zoom/logs" remove_folder "$HOME/.cache/zoom" Which is stupid since it's removing this from root, who probably never ran zoom. Note it removes logs from .zoom, but not the directory its…

Thanks.
Post reply on HN