Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

Post reply on HN
Print view View original

421–430 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#421

Post by Crinus »

ncallaway wrote: post #410
Crinus wrote: post #389

Earlier quoted context omitted.

> At least I am not going to lose sleep over it until Apple does abuse that power. What if Apple abuses that power in ways that not everyone sees as "abuse", yet they are affected by it? The reason you are not already seeing this act as abuse is because you happen to agree with it. What if you didn't agree? What if you were in the minority? What if the reason you where in the minority was that the majority simply did…

This same line of reasoning could apply to any Windows or Mac OS update that disables and removes known viruses and malware. Is it appropriate for Microsoft and Apple to push updates that disable and remove those from infected computers? If so, what is the significant difference?

Windows Defender doesn't remove stuff silently, it shows you notifications, provides control to ignore parts of your computer you know can misfire and you can revert the actions it does.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#422

Post by fauigerzigerk »

pvg wrote: post #416
fauigerzigerk wrote: post #413

Earlier quoted context omitted.

The problem is that Apple appears to have made an exception to its own rules in this particular case. If I understand correctly, they used a first party system update mechanism to change third party software. It's like Google making an ad hoc decision to use Chrome autoupdate to silently patch a particularly bad vulnerability in Microsoft Word just because they can. So what is the principle behind this kind of except…

The problem is that Apple appears to have made an exception to its own rules in this particular case. If I understand correctly, they used a first party system update mechanism to change third party software. I don't see anything in the article that suggests this - as I read it, it pretty much says the opposite. What else have you read that outlined these rules and the exception Apple made?

The article says "Apple said the update does not require any user interaction and is deployed automatically."

As far as I know, there is no system-wide update mechanism for third party software not distributed through the Mac App Store that does not require any user interaction. So apparently they (ab)used the system update mechanism.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#423

Post by Crinus »

pvg wrote: post #409
Crinus wrote: post #399

Earlier quoted context omitted.

These are unimportant details, the issue is with Apple modifying people's computers silently and the users themselves having no knowledge or any say about it. Replace this instance with something that you disagree about (imagine Apple removing VPN software from Chinese customers due to demands from China or "fixing" existing VPN software with backdoors that enable Chinese authorities to wiretap Chinese people) and se…

You brought up the details, inaccurately, to now tell me the details don't matter. You can understand, I hope, how this starts to feel like an exercise in eel juggling.

I didn't brought up details, i explicitly mentioned in my first reply to you to ignore the specifics of this case, ie. the details, and see what happened without them.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#424

Post by vinay_ys »

nixgeek wrote: post #275
vinay_ys wrote: post #270

Earlier quoted context omitted.

Apple or anyone cannot silently pushing changes to my computer without my explicit consent – especially on unrelated things. What Apple did here is also a dark pattern. We cannot commend them and normalize this behavior. This is a dictatorial one-sided decision by Apple. What else can they do? Can nation state governments compel Apple to push stuff silently? Can this system be abused by hackers? Why are we dependent…

It is enabled by default and if you don’t like that you can disable this behavior. https://support.apple.com/en-us/HT204536

We still have not heard anything officially from Apple. Based on other comments here, this removal happened via Malware Removal Tool (MRT) which itself is a hidden tool. If yes, then Apple needs to declare Zoom as Malware. For reference, Apple defines Malware here - https://support.apple.com/en-in/guide/mac-help/mh27449/10.14....

On the other hand, Apple itself is guilty of not addressing gatekeeper vulnerability in time (is still yet to fix this bug): https://9to5mac.com/2019/05/25/macos-gatekeeper-vulnerabilit...

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#425

Post by peteretep »

joejerryronnie wrote: post #280
Deimorz wrote: post #69

Earlier quoted context omitted.

I don't think disabling the enterprise certs was particularly moral, Facebook and Google were flagrantly violating the terms of the enterprise program. Apple also apparently didn't even notice (or didn't care) until articles about it started getting a lot of attention. Apple definitely does make some commendable decisions, but I think it's also important to distinguish between bravery and what Ben Thompson calls "Str…

Yeah, I'm not sure I attribute Apple and Tim Cook's latest stances to strong moral fortitude. I think it's more corporate 101: 1) Public sentiment is hammering companies for perceived privacy violations 2) Our business model does not rely heavily on selling user data 3) Make public statements about how much we value privacy at literally no cost to us 4) Get in a good dig at our competition at the same time

Perhaps. But I also find it easy to buy that a guy who grew up gay in Alabama could think privacy is of fundamental importance.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#426

Post by userbinator »

ncallaway wrote: post #410
Crinus wrote: post #389

Earlier quoted context omitted.

> At least I am not going to lose sleep over it until Apple does abuse that power. What if Apple abuses that power in ways that not everyone sees as "abuse", yet they are affected by it? The reason you are not already seeing this act as abuse is because you happen to agree with it. What if you didn't agree? What if you were in the minority? What if the reason you where in the minority was that the majority simply did…

This same line of reasoning could apply to any Windows or Mac OS update that disables and removes known viruses and malware. Is it appropriate for Microsoft and Apple to push updates that disable and remove those from infected computers? If so, what is the significant difference?

No, and there is no difference, because "infected" in their eyes is not necessarily so in the user's. To give a clear example, AVs have had a long history of false positive problems with things like cracks, keygens, and demoscene productions. Even then, for the most part(? I have not used a persistent AV for a long time) I believe they still tell you first and then let you decide what to do when they find something.

I remember many years ago when the first widespread worms for Windows started circulating. All MS did was publish news and a removal tool. It was publicised greatly, but the ultimate choice was left to the owners of the computers, and that's how it should be.

All the big tech companies (and even a lot of the smaller ones) are becoming increasingly authoritarian, and that's the most concerning thing about this.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#427

Post by matkoniecz »

Digital-Citizen wrote: post #321
rawrmaan wrote: post #35

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

According to the article, "Apple said the update does not require any user interaction and is deployed automatically.". There's nothing moral about using "silent updates" (updates the user has no opportunity to decide whether to adopt). Apple certainly wasn't looking out for their users' privacy and security when they let an iTunes bug go unfixed for 3 years (see http://www.telegraph.co.uk/technology/apple/8912714/Ap…

> There's nothing moral about using "silent updates"

Sorry, but this is absurd. Automatic security updates are necessity. And no user read through all changelogs of all updated software (except extremely critical systems).

Maybe you wanted to argue for ability to downgrade and disable updates?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#428

Post by simion314 »

_ikke_ wrote: post #337
simion314 wrote: post #329

Earlier quoted context omitted.

>~/.config) won't magically get cleaned up. >I'd love to be wrong here, Isn't this what apt purge appname does ? or is something missing Form the apt-get docs: purge - purge is identical to remove except that packages are removed and purged (any configuration files are deleted too).

That would only purge config files that came with the package (which would live in /etc/). Config files in the homedir of a user are not managed by apt.

Thanks, I was wrong, not sure why I believed that it worked. so in the end Linux needs a CCleaner tool like Windows, it should also contain a browser cache cleaner, I sometimes find a few Gb of space in Chromium localstorage/cache and have to hunt them down and delete manually.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#429

Post by scarface74 »

sudhirj wrote: post #313
sudhirj wrote: post #311

Earlier quoted context omitted.

The users who really know what they're doing are going to refuse to disable system integrity protection. I paid a shitload of money for the T2 chip, secure signed boots, a virus-free environment and complete peace of mind from malware. No way I'm turning that off on a work machine. I have a Raspberry Pi for hacking, I'm happy to root the hobby computers, not the work ones.

That's why if find postings like this dangerous. If an author is asking someone to run a command, they really need to explain what the command does and what the tradeoffs are.

The command doesn’t do anything by itself from what so can tell. It just enables the option to run unsigned code.
Post reply on HN