Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

461–470 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#461
post #420

Earlier quoted context omitted.

That doesn't solve the problem because the webserver continues to run even if you have uninstalled Zoom. Source: https://medium.com/bugbountywriteup/zoom-zero-day-4-million-...

Quote: "Then you can delete the ~/.zoomus directory to remove the web server application files."

You'd still have to kill the pid

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#462
post #13

If you would like to force this update you can do so via the terminal: softwareupdate -ia --include-config-data It will show up as MRTConfigData if you look under Apple Menu->About This Mac->System Report->Software->Installations. The latest version is 1.45 and was updated today which includes the Zoom mitigations.

This also install a lot of stuff people may not want to. You can install only the designated package with : softwareupdate -i MRTConfigData_10_14-1.45 --include-config-data

Software Update Tool

MRTConfigData_10_14-1.45: No such update No updates are available.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#463

It's been rather disturbing to see this whole thing play out --- I'm not taking sides here, but Apple "flexing its arms" in this manner shows that it is willing and has the power to go beyond policing its App Store and such (which while I do not like, I feel it does have the right to) and involve itself in the affairs of third-party software which it did not originally install. (This is subtly different from updating…

I'll never understand this argument:

> Apple's wielding of power in this way... the idea of the OS/platform vendor meddling with third-party software...

This is THEIR app store for THEIR operating system. Why in the world would they not be allowed to control their software's features or third party integrations? It reminds me of the ridiculous argument over Windows setting IE as its default browser (and I've been a web dev since the late 90s).

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#464

Earlier quoted context omitted.

Yeah, I'm not sure I attribute Apple and Tim Cook's latest stances to strong moral fortitude. I think it's more corporate 101: 1) Public sentiment is hammering companies for perceived privacy violations 2) Our business model does not rely heavily on selling user data 3) Make public statements about how much we value privacy at literally no cost to us 4) Get in a good dig at our competition at the same time

Perhaps. But I also find it easy to buy that a guy who grew up gay in Alabama could think privacy is of fundamental importance.

Indeed. But I also think that Zuckerberg, Bezos, Page & Brin all value their own privacy. They just don't value your privacy that much.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#465
post #432

Earlier quoted context omitted.

There is nothing in the article that suggests 'abuse' let alone rules, which is what you said. It's not entirely clear exactly what was done here but it was probably an update to the Malware Removal Tool which does what you can surmise from the name, without user interaction.

I care far more about the facts than about what's in the article. Zoom is clearly not malware. It just has a bug. Is updating regular third party software documented behaviour of macOS? If so then I agree that it is not abuse. Otherwise Apple has some explaining to do.

I wouldn't call it a bug. Zoom deliberately engineered their app so it opened a security threat, accessible from any website on your browser, on your local machine without the user's knowledge. Then they reinstalled their software after the user had uninstalled it. Again, deliberately engineered that way.

That is not a bug

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#466
post #152
post #147

Earlier quoted context omitted.

That's it right there. This isn't some gray area, questionable thing like that time they pushed a David Bowie song onto people's iTunes. Remember that? People completely lost their minds over it, and I agree with the sentiment. This isn't third-party anything. No one even knew this was running on their machine and it was demonstrably abusable. Good riddance!

a David Bowie song It was an entire U2 album, a far greater offense.

It’s blasphemous to equate these artists.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#467

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

I still think Apple products are built on human rights abuses. I am currently trying to parse their most recent conflict minerals disclosure. It doesn't explicitly say "yes" but also doesn't clearly say "conflict-free" either.

I’m sure you also love to complain about the problems at the Foxconn ‘Apple factory’. Which in reality builds products for all manufacturers.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#468
post #351

Earlier quoted context omitted.

Jesus Christ, literally do you work for Zoom? This isn't a hot take, this is a fundamental lack of understanding about how macOS, any OS works.

Could you please not slide back into breaking the site guidelines like this? I don't want to ban you, but you've done it repeatedly recently.

Stop pretending this is a conversation, I have no say here...

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#469

Earlier quoted context omitted.

A package manager would typically have removed the web server, too.

As far as I know most traditional package managers only remove files and folders declared in the package. Not files installed somewhere else during the install script or created by the binary when it runs.

Files installed elsewhere during the install script are treated as config files and can be purged, no?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#470

Earlier quoted context omitted.

Perhaps. But I also find it easy to buy that a guy who grew up gay in Alabama could think privacy is of fundamental importance.

Indeed. But I also think that Zuckerberg, Bezos, Page & Brin all value their own privacy. They just don't value your privacy that much.

Zuckerberg definitely does, there are pictures of him with tape over his webcam, microphones taped, ect.
Post reply on HN