Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

321–330 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#321

Post by Digital-Citizen »

rawrmaan wrote: post #35

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

According to the article, "Apple said the update does not require any user interaction and is deployed automatically.". There's nothing moral about using "silent updates" (updates the user has no opportunity to decide whether to adopt).

Apple certainly wasn't looking out for their users' privacy and security when they let an iTunes bug go unfixed for 3 years (see http://www.telegraph.co.uk/technology/apple/8912714/Apple-iT... for more). That bug was said to allowed government spying. Apple's iPhone back door lets Apple delete a user's apps (per http://www.telegraph.co.uk/technology/3358134/Apples-Jobs-co...) but Steve Jobs said it was okay because we can trust Apple ("Hopefully we never have to pull that lever, but we would be irresponsible not to have a lever like that to pull."). Back doors aren't moral, they exist to grant another party over the device the user bought and should own.

The root of all of this is the power of proprietary software (software the user can't inspect, share, or modify, and in some particularly restrictive cases can't always run). Proprietary software is unjust power over the user. There's nothing moral about proprietary software.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#322

Post by microtonal »

rileymat2 wrote: post #244
bandushrew wrote: post #109

Earlier quoted context omitted.

that is explicitly incorrect. macos has a very nice and effective way of packaging all the components needed by an app into tidy bundles. the problem in this case is that the developers just couldn't be assed even trying.

Not really, If you have a standard app that can be dragged into the trash, sure. If you have a kernel extension, or a launch deamon or any application data you store locally you cannot clean up after yourself without a custom uninstaller. Windows is far ahead in its centralized Add&Remove Programs area.

Not really, If you have a standard app that can be dragged into the trash, sure. If you have a kernel extension, or a launch deamon or any application data you store locally you cannot clean up after yourself without a custom uninstaller.

This is false. Kernel extensions can be part of the application bundle and will be unloaded and removed when the bundle is removed.

Installing KEXTs in an application bundle allows an application to register those KEXTs without the need to install them permanently elsewhere within the system hierarchy. This may be more convenient and allows the KEXT to be associated with a specific, running application. When it starts, the application can register the KEXT and, if desired, unregister it on exit.

For example, a network packet sniffer application might employ a Network Kernel Extension (NKE). A tape backup application would require that a tape driver be loaded during the duration of the backup process. When the application exits, the kernel extension is no longer needed and can be unloaded.

Source: https://developer.apple.com/library/archive/documentation/Da...

You can also launch agents that are part of your application bundle:

https://developer.apple.com/documentation/servicemanagement/...

It is true that you cannot remove application data, but that is a feature (maybe users want to retain the data) and also does not happen in e.g. Linux package managers.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#323

Post by BinaryIdiot »

userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

> You may agree with its decision this time, but will you always agree?

To be honest I'm kinda sick of this argument. Someone brings this argument up _every single time_ a tech company takes action against something malicious. It's a strawman argument at best and at worst a way to give people an out on acting against something that could harm the user.

> Apple's wielding of power in this way is likely to attract the attention of groups such as copyright/IP lobbyists, which have an immense desire to have all "non-authorised" files/software erased from all user's machines.

This will never happen.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#324

Post by dymk »

oil25 wrote: post #206
xenadu02 wrote: post #180

Earlier quoted context omitted.

> They provide the Chinese government backdoor access to iMessage No. What gave you this idea? iMessage is end-to-end encrypted. The keys are managed by the devices themselves. There is no facility to backdoor or intercept the messages. Apple acts as a registration server, notifying your devices when a new device signed in as you joins the pool but the devices themselves tell you when this has happened. That’s all cl…

> iMessage is end-to-end encrypted. The keys are managed by the devices themselves. There is no facility to backdoor or intercept the messages. That is only a half-truth. Apple controls the key infrastructure; they may replace your keys with arbitrary ones at the demand, coercion or compromise by any number of bad actors. The software is closed source, making it impossible to verify any actual claims made otherwise.…

I find it disappointing that we blame companies operating in China and not the real forcing function for all this: the Chinese government

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#325

Post by layoutIfNeeded »

hunter2_ wrote: post #297
pishpash wrote: post #286

Earlier quoted context omitted.

Such a system would not allow the application to write to any place outside of its sandbox or a designated user document volume. The system can't be touched. If you want to create a system config file, you are responsible to break the glass and move it and then all bets are off.

I can imagine an allowance to "break the glass" within the context of the app so long as the app invokes an obvious-to-the-user common dialog (like the typical file>save / file>open / choose-a-folder), but there would be no "breaking the glass" in an invisible / programmatic manner. That sounds quite nice.

That’s exactly how the macOS AppStore apps work. Your app gets permission only to those files that were intentionally opened by the user via the system open dialog.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#326

Post by useerup »

buzzerbetrayed wrote: post #266
ComputerGuru wrote: post #239

Earlier quoted context omitted.

> all of those files are generally still left behind on Windows as well. Citation needed. That was the case in the 90s, these days most apps (device drivers aside) uninstall fairly cleanly with only settings/configurations stored in the registry still resident afterwards. Startup programs remaining after an uninstall is straight-up a bug.

> these days most apps (device drivers aside) uninstall fairly cleanly Citation needed.

Windows installers are declarative and data-driven. An installer script does not simply use the file copy operations a usual app would use during runtime.

Instead an installer is driven by a number of "database" tables that specify the installer actions in a declarative way.

There are several benefits to this approach. The declarative actions are reversible and the uninstall actions can thus be inferred automatically. This removes the burden on install authors to create a script to reverse the install operations.

This includes registering services/daemons (will unregister on uninstall), registering protocol handlers, filetype/program associations, desktop shortcuts etc.

The declarative approach also allows the installer to roll back in case of an error during installation. This even includes "undeleting" files that were deleted. (https://docs.microsoft.com/en-us/windows/win32/msi/rollback-...)

The author of the install script can (non-Store installers) escape and execute a specific program during the install process. This is rarely needed, though. So the default is that the uninstaller will uninstall by completely reversing the install actions.

https://docs.microsoft.com/en-us/windows/win32/msi/windows-i...

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#327

Post by dingaling »

rorykoehler wrote: post #115
userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

I'm fine with this. I can always leave Apple and go to Linux if they do something drastic.

After years of pouring thousands of dollars into Apple's coffers you expect that Linux will still be there when you need it...

Real principles would involve switching now.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#328

Post by pjmlp »

rleigh wrote: post #315
pjmlp wrote: post #309

Earlier quoted context omitted.

iPhone and iPad don't seem to have suffered from lack of open source projects. Neither do game consoles or the large population using Windows based systems. I never cared for brew on the occasional moments I get to use Apple computers, XCode and default tooling is more than enough. Which is like what the large majority of developers targeting Apple devices actually care about.

The MacBook is a general purpose computing platform. The iPhone and iPad are not. Locking down the Mac will make it unusable for many, many people. It will indeed be the death of the platform, as most devs abandon it entirely.

The large majority of devs that buy Macs aren't UNIX FOSS devs, rather devs that care about Apple platform.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#329

Post by simion314 »

mceachen wrote: post #148
taftster wrote: post #126

Earlier quoted context omitted.

Which is completely frustrating, because Mac is totally in the position of using its built-in capabilities to deal with this. The Mac Bundle (.app) format could solve this entirely. All application specific data should be written inside of the bundle folder, so that when you delete the app, you delete the thing entirely. I mean, maybe you need a "user data" bundle of sorts tied to the specific application. If you del…

I'd argue that linux distros have this power, too, and they haven't either (unless you use a snap, which has compatibility and performance issues). If you uninstall a .deb or .rpm or AppImage, the files you wrote into XDG_CONFIG_HOME (defaults to ~/.config) won't magically get cleaned up. I'd love to be wrong here, BTW! I've had several PhotoStructure users try to reset their configuration by uninstall/reinstall, but…

>~/.config) won't magically get cleaned up. >I'd love to be wrong here,

Isn't this what apt purge appname does ? or is something missing

Form the apt-get docs:

purge - purge is identical to remove except that packages are removed and purged (any configuration files are deleted too).

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#330

Post by kabwj »

universenz wrote: post #129
fouc wrote: post #63

Earlier quoted context omitted.

Quite a few apps ask for root during installation. But now you have me wondering which apps ask for root and which don't. Would be neat if there was a huge app registry website that could show this. Name and shame the ones that ask for root..

Let me introduce you to the nice folks over at Objective See.. https://objective-see.com/products.html They have a bunch of cool little apps (that are free) like BlockBlock that let you know when things are happening you wouldn't have otherwise allowed. For example, BlockBlock warned me randomly about 30 minutes ago about an app that was being silently installed in the background.. something I hadn't seen before call…

That’s funny. Windows’ own tool for these matters is called... MRT.exe
Post reply on HN