Apple has pushed a silent Mac update to remove hidden Zoom web server • Hacker News Board

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#381

Post by madeofpalk » Thu, Jul 11, 2019, 9:19 AM UTC

danso wrote: post #247

rawrmaan wrote: post #35

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

I do appreciate Apple's overall stance and actions regarding privacy, but I see this as a very practical action for their own self-interest. Apple has staked its reputation on privacy. The headline-level summary of this incident is that Mac users are exclusively affected by Zoom's bug/security hole. Among consumers, unauthorized access to the webcam is the epitome of modern invasion of privacy. All it takes is one Ap…

Why not both?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#382

Post by fauigerzigerk » Thu, Jul 11, 2019, 9:21 AM UTC

pvg wrote: post #263

userbinator wrote: post #261

Earlier quoted context omitted.

The point is precisely NOT to think about only this one case like many others seem to be focusing (or Zoom-ing in...?) on, but to consider how far you are willing to let Apple exercise its power over your computer. Would you let it scan all your files and delete e.g. "suspected images of child abuse" (to use an old cliche)? Suspected copyrighted material or fragments thereof? "Extremist" content, or content which is…

You can take any capability and stretch it out to some absurd extreme. What if apt-get whatnot trashed your entire computer? What if buses started hunting pedestrians for sport? It's a line of inquiry that prioritizes handwringing over insight.

Has anyone ever asked bus companies to start hunting pedestrians for sport? The answer is clearly no.

Contrary to that, the demands from governments and others for tech companies to "take responsibility" and become enforcers of all sorts of perceived virtues is reaching a crescendo.

And it's not just about clearly dangerous things like child porn or terrorism. The UK government seriously demands the takedown of "harmful but not illegal" content.

Just think about that concept of "harmful but not illegal" for a moment and you'll see that the sort of overreach that userbinator is talking about is anything but "some absurd extreme".

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#383

Post by simon1573 » Thu, Jul 11, 2019, 9:30 AM UTC

walrus01 wrote: post #196

scarface74 wrote: post #191

Earlier quoted context omitted.

If Apple removed a piece of ransomware that you installed would you have a problem with that? Do you think anyone would have installed Zoom if they knew that it would allow any random website to activate your camera?

No, and I'm 100% in agreement with the need for it to be removed, it was clearly malware. The question I see is really that Apple doesn't inform its users of the existence of this feature, unless you really search for it. Having something as simple as a functional-equivalent to Windows Defender with its own icon in Control Panel, which is fully enabled in the default operating system installation, should be sufficien…

One could speculate in whether that is a conscious decision, since it would weaken the illusion that only Windows gets malware.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#384

Post by Slartie » Thu, Jul 11, 2019, 9:37 AM UTC

krferriter wrote: post #99

gaogao wrote: post #66

Earlier quoted context omitted.

Razer gaming keyboard drivers spin up a webserver for controlling the chroma, which I've always found scary. (Using the much more reasonable community open source drivers that don't do that.)

Why in the world would a keyboard driver need to run a webserver? Client software should just be able to call driver functions directly in order to configure the keyboard. It sounds like they hired a web developer to write their driver configuration tool and didn't give any architectural constraints or have someone managing the project who knows best practices or security principles.

> they hired a web developer to write their driver configuration tool

This is the real problem behind all of these cases of "why the heck is tool/driver/app/whatever X running a web server locally?" - the market is full of developers only knowing HTTP, and when someone just has a hammer, every problem looks like a nail.

There is a real shortage of devs who know about all the other IPC techniques supported by modern OSes (of which practically all of them are much faster, lower latency, less overhead-y, more secure and come with less unintended side effects than a local web server).

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#385

Post by scarface74 » Thu, Jul 11, 2019, 9:40 AM UTC

pjmlp wrote: post #308

scarface74 wrote: post #302

Earlier quoted context omitted.

For users who know what they are doing: https://forums.macrumors.com/threads/unsigned-apps-catalyst-... sudo spctl --master-disable

Which are a very tiny percentage of typical Mac users.

As it should be. The vast majority of users should only run signed software. That leaves the ones who know what they are doing a way to bypass it.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#386

Post by pvg » Thu, Jul 11, 2019, 9:41 AM UTC

fauigerzigerk wrote: post #382

pvg wrote: post #263

Earlier quoted context omitted.

You can take any capability and stretch it out to some absurd extreme. What if apt-get whatnot trashed your entire computer? What if buses started hunting pedestrians for sport? It's a line of inquiry that prioritizes handwringing over insight.

Has anyone ever asked bus companies to start hunting pedestrians for sport? The answer is clearly no. Contrary to that, the demands from governments and others for tech companies to "take responsibility" and become enforcers of all sorts of perceived virtues is reaching a crescendo. And it's not just about clearly dangerous things like child porn or terrorism. The UK government seriously demands the takedown of "harm…

I still have a lot of trouble seeing how Apple removing a critical vulnerability - a completely mundane act with plenty of precedent from both Apple and others - is some clarion call that, if left unheeded, will have Siri judging everyone's hentai collection next. Why this - preventing myriads of users from becoming campeople - of all things? Why not, say, every Chrome autoupdate ever?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#387

Post by Slartie » Thu, Jul 11, 2019, 9:43 AM UTC

nemothekid wrote: post #154

krferriter wrote: post #99

Earlier quoted context omitted.

Why in the world would a keyboard driver need to run a webserver? Client software should just be able to call driver functions directly in order to configure the keyboard. It sounds like they hired a web developer to write their driver configuration tool and didn't give any architectural constraints or have someone managing the project who knows best practices or security principles.

I don’t have the keyboard, but it’s my understanding that application developers can customize the lights on the keyboard. For example if you die in the game your keyboard turns red. To do that you need IPC, and a JSON endpoint is the most popular form of RPC. If the server listens on localhost, I don’t see any issue with it - any issue you would have with IPC, you would have with this style of of RPC. Now they could…

> Now they could have provided a library to communicate directly with the keyboard

They could have also opened a named pipe. Much cleaner, faster, less overhead than a web server, and way more secure (last time I checked, a website could not simply perform a request on a named pipe via JavaScript. With a local web server however...).

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#388

Post by Crinus » Thu, Jul 11, 2019, 9:47 AM UTC

pvg wrote: post #386

fauigerzigerk wrote: post #382

Earlier quoted context omitted.

Has anyone ever asked bus companies to start hunting pedestrians for sport? The answer is clearly no. Contrary to that, the demands from governments and others for tech companies to "take responsibility" and become enforcers of all sorts of perceived virtues is reaching a crescendo. And it's not just about clearly dangerous things like child porn or terrorism. The UK government seriously demands the takedown of "harm…

I still have a lot of trouble seeing how Apple removing a critical vulnerability - a completely mundane act with plenty of precedent from both Apple and others - is some clarion call that, if left unheeded, will have Siri judging everyone's hentai collection next. Why this - preventing myriads of users from becoming campeople - of all things? Why not, say, every Chrome autoupdate ever?

> I still have a lot of trouble seeing how Apple removing a critical vulnerability

You have that trouble because you are focusing on the "critical vulnerability" part and ignoring the fact that Apple decided to uninstall a program they had nothing to do with from your computer without your consent.

The intentions might be noble, the implications however are less so.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#389

Post by Crinus » Thu, Jul 11, 2019, 9:53 AM UTC

whalesalad wrote: post #194

userbinator wrote: post #110

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

I was waiting for this comment. > You may agree with its decision this time, but will you always agree? Yes, I will. At least I am not going to lose sleep over it until Apple does abuse that power. I am actually even more happy to be an Apple user knowing that the mothership said hell naw to the naw naw naw naw to this horseshit Zoom has been pulling. If I were Apple, I'd be taking this as a personal slight against m…

> At least I am not going to lose sleep over it until Apple does abuse that power.

What if Apple abuses that power in ways that not everyone sees as "abuse", yet they are affected by it?

The reason you are not already seeing this act as abuse is because you happen to agree with it. What if you didn't agree? What if you were in the minority? What if the reason you where in the minority was that the majority simply didn't had the necessary understanding, experience and/or knowledge to see the issue you see?

If something can be abused, it will be abused, there isn't a matter of if, it is a matter of when. And with that in mind it is better to try and avoid being abused than wait for the abuse to happen and see what you can do after the fact.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#390

Post by simonh » Thu, Jul 11, 2019, 9:54 AM UTC

chongli wrote: post #364

Retric wrote: post #193

Earlier quoted context omitted.

That’s another issue. As an organization is viewed as less ethical, only less ethical people join creating a downward spiral.

Hopefully the unethical organization develops a reputation for being unethical. Then only unethical people will patronize said organization. Ideally, unethical behaviour leads to marginalization, though obviously that does not always happen in practice.

Samsung are a strong counter-example. They're been caught red handed doing all sorts of truly nasty stuff. Pretty much anything Apple has even been suggested as doing, they've been enthusiastically up to their eyeballs in and a lot more, but they seem to just shrug off the negative press like water off a duck's back.

I think once a company develops a reputation like that, most people just get desensitised to it. Also there is a degree to which lower cost products get a pass, because hey, they must be cutting corners somewhere.