Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

301–310 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#301

Post by asveikau »

pjmlp wrote: post #267
xoa wrote: post #168

Earlier quoted context omitted.

> It effectively breaks their sandbox model The sandbox only applies to software devs that want to use it or those that wish to sell through the Mac App Store. I don't think Zoom is in the MAS at all (I don't see it in a quick search anyway), and a standalone installer is free to do whatever it wants and can convince users to go along with (up to and including, in principle, bypassing SIP though since that significan…

Not after Catalina. Future versions of macOS will require signed software (notarized as per Apple terminology), even outside of the store. What is new in security at WWDC.

I don't fully understand the difference. But signed is different from notarized. Notarized means you uploaded the binary to Apple. Previously, you can sign without doing that.

I haven't looked enough to understand what is gained by notary. Does Apple want to search your binary for maliciousness or rulebreaking (potentially even at a later date) so that it might revoke the notarization/signature?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#302

Post by scarface74 »

sudhirj wrote: post #299
scarface74 wrote: post #276

Earlier quoted context omitted.

Neither statement is true. There is still the same control-click to open non signed software and there is still no aggressive permission model outside of the App Store.

There is, but even the control click will only allow you to open signed software. Unless you build the software yourself (I'm not sure how homebrew still works) you cannot run it if it's not been notarized by Apple. Firefox was broken on Catalina for a while, even though the main app was notarized. Some internal binary wasn't notarized, and no amount of control clicking would get Firefox to work until Mozilla notariz…

For users who know what they are doing:

https://forums.macrumors.com/threads/unsigned-apps-catalyst-...

  sudo spctl --master-disable

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#303

Post by pjmlp »

philo23 wrote: post #296
pjmlp wrote: post #267

Earlier quoted context omitted.

Not after Catalina. Future versions of macOS will require signed software (notarized as per Apple terminology), even outside of the store. What is new in security at WWDC.

Signed is not the same to Sandboxed on macOS, afaik.

Watch the security talk. macOS is on the path to adopt iOS permissions model and long term roadmap is to apply the sandbox to everything, with the option to explicitly disable it on per-case basis.

A path similar to how Windows 10 is now converging the Win32 and UWP sanbox models, or how ChromeOS sandboxes GNU/Linux processes.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#304

Post by asveikau »

geofft wrote: post #246
londons_explore wrote: post #102

Earlier quoted context omitted.

Because macos has no decent concept of package management or containerization.

macOS has a very good concept of package management and containerization. It's just optional because people get even more up in arms when their old software doesn't work any more. Apple also makes a fantastic computing platform with very good mandatory isolation, namely, iOS. If you're interested in isolation in preference to compatibility with traditional desktop software, an unjailbroken iPad Pro with Smart Keyboar…

I don't think it's just old software that might break. One must also consider the software not yet to be written. If the isolation is too constraining for some type of application that really needs a privilege, and isolation is mandatory, then some amount of innovation will just have to happen somewhere else or not at all.

Remember old school Mac was full of hacks upon hacks upon hacks, many by third parties, and there was cool stuff in there too. The App Store mentality has caused everyone to overreact and think that every third party app on the planet will turn into the worst conception of Win98 era malware overnight if unconstrained, when this is just one outcome among many possible.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#305

Post by vbsteven »

nitrogen wrote: post #273
Operyl wrote: post #107

Earlier quoted context omitted.

I mean. The issue at hand was that they purposely left the webserver behind to auto reinstall if a zoom link was clicked. This was an intended feature, and the same could have been done on Linux or Windows. Package management or containers are irrelevant to this conversation.

A package manager would typically have removed the web server, too.

As far as I know most traditional package managers only remove files and folders declared in the package. Not files installed somewhere else during the install script or created by the binary when it runs.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#306

Post by pjmlp »

asveikau wrote: post #301
pjmlp wrote: post #267

Earlier quoted context omitted.

Not after Catalina. Future versions of macOS will require signed software (notarized as per Apple terminology), even outside of the store. What is new in security at WWDC.

I don't fully understand the difference. But signed is different from notarized. Notarized means you uploaded the binary to Apple. Previously, you can sign without doing that. I haven't looked enough to understand what is gained by notary. Does Apple want to search your binary for maliciousness or rulebreaking (potentially even at a later date) so that it might revoke the notarization/signature?

In order to avoid repeating myself, from WWDC 2019:

"Advances in macOS Security"

https://developer.apple.com/videos/play/wwdc2019/701/

"All About Notarization"

https://developer.apple.com/videos/play/wwdc2019/703

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#307

Post by sschueller »

pjmlp wrote: post #267
xoa wrote: post #168

Earlier quoted context omitted.

> It effectively breaks their sandbox model The sandbox only applies to software devs that want to use it or those that wish to sell through the Mac App Store. I don't think Zoom is in the MAS at all (I don't see it in a quick search anyway), and a standalone installer is free to do whatever it wants and can convince users to go along with (up to and including, in principle, bypassing SIP though since that significan…

Not after Catalina. Future versions of macOS will require signed software (notarized as per Apple terminology), even outside of the store. What is new in security at WWDC.

That will be the Mac books death.

Many open source projects will not participate in this.

If this kills brew you will also loose a lot of devs.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#308

Post by pjmlp »

scarface74 wrote: post #302
sudhirj wrote: post #299

Earlier quoted context omitted.

There is, but even the control click will only allow you to open signed software. Unless you build the software yourself (I'm not sure how homebrew still works) you cannot run it if it's not been notarized by Apple. Firefox was broken on Catalina for a while, even though the main app was notarized. Some internal binary wasn't notarized, and no amount of control clicking would get Firefox to work until Mozilla notariz…

For users who know what they are doing: https://forums.macrumors.com/threads/unsigned-apps-catalyst-... sudo spctl --master-disable

Which are a very tiny percentage of typical Mac users.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#309

Post by pjmlp »

sschueller wrote: post #307
pjmlp wrote: post #267

Earlier quoted context omitted.

Not after Catalina. Future versions of macOS will require signed software (notarized as per Apple terminology), even outside of the store. What is new in security at WWDC.

That will be the Mac books death. Many open source projects will not participate in this. If this kills brew you will also loose a lot of devs.

iPhone and iPad don't seem to have suffered from lack of open source projects.

Neither do game consoles or the large population using Windows based systems.

I never cared for brew on the occasional moments I get to use Apple computers, XCode and default tooling is more than enough.

Which is like what the large majority of developers targeting Apple devices actually care about.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#310

Post by Operyl »

nitrogen wrote: post #273
Operyl wrote: post #107

Earlier quoted context omitted.

I mean. The issue at hand was that they purposely left the webserver behind to auto reinstall if a zoom link was clicked. This was an intended feature, and the same could have been done on Linux or Windows. Package management or containers are irrelevant to this conversation.

A package manager would typically have removed the web server, too.

Sure, the "package managers" on Linux, Windows, and macOS all behavior in pretty similar fashions. A manifest of files that the installer knew at time of install. That doesn't stop a program from installing anything else at run time, or even in the installer (since they can define what to remove in a lot of cases). This wasn't an "accident," it was purposely left behind with the intention of being used to onboard users easily even after they removed the client. This would have pretty much been an issue on every platform (had it been implemented on other platforms). And please, don't tell me "but Docker!" Docker, at present, isn't really usable with GUI applications yet.
Post reply on HN