Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

341–350 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#341
post #335
post #328

Earlier quoted context omitted.

The large majority of devs that buy Macs aren't UNIX FOSS devs, rather devs that care about Apple platform.

This doesn't match my experience so far, could you point me to your sources for this claim?

Just like you, my experience so far.

Then again, I only hang around with Mac devs that target iDevices and macOS, using Objective-C, Swift, C++ and Web.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#342

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

Logically this suggests not that Apple should stop removing malicious software but perhaps should have user visibility and control over the process.

For example if you classify possibly unwanted programs from annoying toolbars to randomware on a scale of 1-3 it might be reasonable to provide a checkbox to allow the user to switch between being warned of a negative program and being given the option to uninstall and having this happen automatically for non critical situations.

If the default is to on then 99% of users will be protected.

Arguably stuff like ransomware shouldn't be optional lest the malware set the option.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#343

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

I still think Apple products are built on human rights abuses. I am currently trying to parse their most recent conflict minerals disclosure. It doesn't explicitly say "yes" but also doesn't clearly say "conflict-free" either.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#344

Huh? Why is it ok for Apple or anyone to do silent installs on my computer? As a customer, why am I getting this information from YC/Techcrunch and not Apple? What else have they pushed like this? Is there a transparent log? Can we verify if their track record is clean? How many times have they silently broken and fixed their own things? How do we know they won't abuse this? Isn't this the same dark pattern that we c…

> Isn't this the same dark pattern that we criticized zoom for? Did I consent to Apple doing silent editorial changes to my system?

Because as opposed to what Zoom did, this is a feature that you can turn off if you want in "Updates" preference pane.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#345
post #320
post #69

Earlier quoted context omitted.

I don't think disabling the enterprise certs was particularly moral, Facebook and Google were flagrantly violating the terms of the enterprise program. Apple also apparently didn't even notice (or didn't care) until articles about it started getting a lot of attention. Apple definitely does make some commendable decisions, but I think it's also important to distinguish between bravery and what Ben Thompson calls "Str…

"Strategy Credits" were rebranded as "Virtue Signaling" circa 2017

Those are very different things. The former is doing the latter is showing.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#346

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

According to the article, "Apple said the update does not require any user interaction and is deployed automatically.". There's nothing moral about using "silent updates" (updates the user has no opportunity to decide whether to adopt). Apple certainly wasn't looking out for their users' privacy and security when they let an iTunes bug go unfixed for 3 years (see http://www.telegraph.co.uk/technology/apple/8912714/Ap…

Every browser and most other important software now does auto-updates with no user interaction. ESPECIALLY for security issues.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#347
post #225
post #69

Earlier quoted context omitted.

I don't think disabling the enterprise certs was particularly moral, Facebook and Google were flagrantly violating the terms of the enterprise program. Apple also apparently didn't even notice (or didn't care) until articles about it started getting a lot of attention. Apple definitely does make some commendable decisions, but I think it's also important to distinguish between bravery and what Ben Thompson calls "Str…

I'm not convinced that morality and self-interest are mutually exclusive. Very often the best decision for a given entity to make is a moral one. We should still reward/praise companies who make decisions that are morally superior to their competitors, regardless of whether the morality itself was a primary motivation.

I personally believe morality and self interest strongly overlap over the long term, but short term they are largely independent conditional on the probability of getting caught...

Humans might have too short lifespans, memories and limited rationality for the long term benefit of morality to be strongly in our individual self interest though... one of the possible benefits of anti-aging and cognitive enhancement tech is it might incentivize us to be more moral all other things equal as a side effect.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#348
post #245
post #42

This means there might have been another side to this story: Zoom's change of heart might have been forced by Apple, not the public backlash. Apple: Hey, your app poses a threat to macOS security. We're going to remove your server app with the built-in macOS anti-virus. Zoom: Oh crap. Okay, give us 2 sprints to release a new version that removes it. Apple: We're killing it in 48 hours. ... Zoom, after an all-nighter:…

Wild speculation.

Wouldn't say so.

The who found the Vulnerability where at least talking to the people at chrome and firefox: Quote from there Blogpost (https://medium.com/bugbountywriteup/zoom-zero-day-4-million-...) "Apr 10, 2019 — Vulnerability disclosed to Chromium security team.

Apr 19, 2019 — Vulnerability disclosed to Mozilla FireFox security team."

So, not entirely unrealistic that the other Browser manufacturer also got a notice.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#349
post #69

Earlier quoted context omitted.

I don't think disabling the enterprise certs was particularly moral, Facebook and Google were flagrantly violating the terms of the enterprise program. Apple also apparently didn't even notice (or didn't care) until articles about it started getting a lot of attention. Apple definitely does make some commendable decisions, but I think it's also important to distinguish between bravery and what Ben Thompson calls "Str…

> Apple also apparently didn't even notice Do they have any information about enterprise apps? As I understand it, Apple never phones home with app info (such as the identifier, name, etc) when verifying or installing enterprise-signed apps, so the only thing they know is probably the IP address requesting to verify the enterprise-signed app and the frequency of how often Apple devices do this certificate verificatio…

Going forwards, Apple will require that companies provide their enterprise apps to be audited.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#350

Earlier quoted context omitted.

I'm fine with this. I can always leave Apple and go to Linux if they do something drastic.

After years of pouring thousands of dollars into Apple's coffers you expect that Linux will still be there when you need it... Real principles would involve switching now.

I like Apple products and software. Why would I switch?
Post reply on HN