Apple has pushed a silent Mac update to remove hidden Zoom web server • Hacker News Board

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#481

Post by gurkendoktor » Thu, Jul 11, 2019, 5:09 PM UTC

efaref wrote: post #479

tinus_hn wrote: post #467

Earlier quoted context omitted.

I’m sure you also love to complain about the problems at the Foxconn ‘Apple factory’. Which in reality builds products for all manufacturers.

So "everyone else does it" is a valid defense? Apple charges $1k for their monitor stands. I think they can afford to build their stuff at a factory that doesn't use modern slavery.

I agree that Apple is incredibly greedy and hypocritical, but in the end, working at Foxconn is just another underpaid job. I think the term "modern slavery" should be reserved for people whose passport has been taken away, who are trapped on a fishing boat or in a brothel for life, who have been tricked into accepting debt etc.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#482

Post by stordoff » Thu, Jul 11, 2019, 5:17 PM UTC

walrus01 wrote: post #116

castis wrote: post #113

Earlier quoted context omitted.

How do you feel about Windows Defender?

I think the difference here is that apple explicitly does not have an "anti malware" configuration section of the MacOS control panel. There's configuration for automated system updates, which most technical people understand to mean security patches and things that are equivalent to windows hotfixes and servicepacks. I am with the "two wrongs don't make a right" people here. Zoom was reckless and their casual disreg…

> There's configuration for automated system updates, which most technical people understand to mean security patches and things that are equivalent to windows hotfixes and servicepacks.

Microsoft do exactly the same, and have done for over a decade now:

> Malicious Software Removal Tool is a freely distributed virus removal tool developed by Microsoft for the Microsoft Windows operating system. First released on January 13, 2005, it is an on-demand anti-virus tool ("on-demand" means it lacks real-time protection) that scans the computer for specific widespread malware and tries to eliminate the infection. [...] The program is usually updated on the second Tuesday of every month (commonly called "Patch Tuesday") and distributed via Windows Update, at which point it runs once automatically in the background and reports if malicious software is found.

https://en.wikipedia.org/wiki/Malicious_Software_Removal_Too...

> Having something as simple as a functional-equivalent to Windows Defender with its own icon in Control Panel

MSRT is independent from Windows Defender.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#483

Post by floatingatoll » Thu, Jul 11, 2019, 5:25 PM UTC

wwright wrote: post #77

xeeeeeeeeeeenu wrote: post #72

They are basically solving a self-inflicted problem. The real issue there is the fact that macOS doesn't provide a standarized way to completely uninstall an app.

It does provide a standard way to uninstall an app : drag it to the trash can. I would say that what Zoom did was have their app intentionally install malware that bypassed this normal uninstall. I do think that it would be great to have a more thoroughly sandboxed idea of what an “app” is on the desktop, though.

Malware intends to harm you, with intent to steal or destroy or hold hostage your information, data, and computing resources.

Does the ZoomOpener app have malicious intentions towards you, your computing resources, or your data? Not just “could it be unintentionally exploited” - note the unintentionality! - but specifically “this was intended to harm”.

If not, then you need to reconsider your use of the word “malware” - a word shortened from “malicious software” - and find a better way to describe software design patterns that aren’t compatible with “drag it to the trash” but also aren’t intended to harm.

Adobe Creative Cloud, any $$$$ audio software DRM, and HP printer drivers all use similar patterns of “can’t just drag it to the trash”, and are all similarly annoying to remove - but they are not malware, any more than this ZoomOpener is.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#484

Post by dwaite » Thu, Jul 11, 2019, 5:33 PM UTC

DickSmith wrote: post #281

m0dest wrote: post #42

This means there might have been another side to this story: Zoom's change of heart might have been forced by Apple, not the public backlash. Apple: Hey, your app poses a threat to macOS security. We're going to remove your server app with the built-in macOS anti-virus. Zoom: Oh crap. Okay, give us 2 sprints to release a new version that removes it. Apple: We're killing it in 48 hours. ... Zoom, after an all-nighter:…

I've been on the Catalina Beta since the week of WWDC, and Zoom hasnt worked for me until the update today. The loading modal would come up, but the app window would never open and I would have to force kill the app entirely, since I couldn't close the modal. I suspect that Apple had already closed the possibility of the loophole on Catalina, which is why it wasn't working. So I suspect they had probably noticed it w…

I believe the issues running Zoom were due to tightening of security in Catalina for screen capture.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#485

Post by la_barba » Thu, Jul 11, 2019, 5:44 PM UTC

vinay_ys wrote: post #270

rawrmaan wrote: post #35

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

Apple or anyone cannot silently pushing changes to my computer without my explicit consent – especially on unrelated things. What Apple did here is also a dark pattern. We cannot commend them and normalize this behavior. This is a dictatorial one-sided decision by Apple. What else can they do? Can nation state governments compel Apple to push stuff silently? Can this system be abused by hackers? Why are we dependent…

That boat sailed when google chrome launched 10+ years ago. Users don't care that applications come built-in with the ability to download a binary and execute it without the users permission. The market has chosen convenience over security. Yes, its a dark pattern, and Apple uses dark patterns themselves (for e.g. to trick you into updating iOS). Its going to be a monumental uphill battle to change this trend..

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#486

Post by pvg » Thu, Jul 11, 2019, 5:52 PM UTC

fauigerzigerk wrote: post #439

pvg wrote: post #432

Earlier quoted context omitted.

There is nothing in the article that suggests 'abuse' let alone rules, which is what you said. It's not entirely clear exactly what was done here but it was probably an update to the Malware Removal Tool which does what you can surmise from the name, without user interaction.

I care far more about the facts than about what's in the article. Zoom is clearly not malware. It just has a bug. Is updating regular third party software documented behaviour of macOS? If so then I agree that it is not abuse. Otherwise Apple has some explaining to do.

Sure, facts are important. You started here:

The problem is that Apple appears to have made an exception to its own rules in this particular case. If I understand correctly, they used a first party system update mechanism to change third party software.

I don't think any of these are established facts and I don't understand how you, a fellow fact-fancier, haven't acknowledged that before breezily moving on to a discussion of the precise definition of the term 'malware'.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#487

Post by throwaway2048 » Thu, Jul 11, 2019, 6:00 PM UTC

lmm wrote: post #372

pvg wrote: post #263

Earlier quoted context omitted.

You can take any capability and stretch it out to some absurd extreme. What if apt-get whatnot trashed your entire computer? What if buses started hunting pedestrians for sport? It's a line of inquiry that prioritizes handwringing over insight.

No, it prioritizes thinking about clear boundaries ahead of time, while you're able to think clearly about the issues. "Hard cases make bad law" as the lawyers say. Ethicists do this sort of thing all the time. There's a line between the OS and third-party software. There's a line between malicious software and accidentally vulnerable. Apple has just shown that it is willing to cross both those lines. Where is the li…

Lets ask a reasonable question: who wants the zoom webserver running on their systems providing a backdoor.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#488

Post by nottorp » Thu, Jul 11, 2019, 6:00 PM UTC

taftster wrote: post #211

moduspol wrote: post #169

Earlier quoted context omitted.

As a Mac app developer, you mostly have to go out of your way to install things[1] outside of the app bundle, and you typically don't want to because that's only extra maintenance you have to do to update / version those files. Most apps don't, and that's why most apps actually are effectively removed when you drag the bundle into the trash. There is already a concept of a "user data" directory for the app, which is…

Thanks for the reply, really good stuff. But what I don't get, why even have an "Application Support" directory at all. There is absolutely nothing of value added to me (as a user) to have files stored there. It's just one more place I have to look to clean up after an application is deleted. So dumb and adds zero value. I'll put my files into Documents (or whatever). And you (as an application developer) put your fi…

Most of the time, the app's directory in Application Support has the per-user configuration files. And games put their saves there. In both cases, I really don't mind the files staying. I can always change my mind, reinstall the app and resume where i left off.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#489

Post by rabboRubble » Thu, Jul 11, 2019, 6:08 PM UTC

lelf wrote: post #355

vondur wrote: post #13

If you would like to force this update you can do so via the terminal: softwareupdate -ia --include-config-data It will show up as MRTConfigData if you look under Apple Menu->About This Mac->System Report->Software->Installations. The latest version is 1.45 and was updated today which includes the Zoom mitigations.

To check it with fewer mouse clicks: system_profiler SPInstallHistoryDataType |grep -A5 MRTConfigData

Helpful! Thanks...

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#490

Post by rleigh » Thu, Jul 11, 2019, 6:08 PM UTC

pjmlp wrote: post #328

rleigh wrote: post #315

Earlier quoted context omitted.

The MacBook is a general purpose computing platform. The iPhone and iPad are not. Locking down the Mac will make it unusable for many, many people. It will indeed be the death of the platform, as most devs abandon it entirely.

The large majority of devs that buy Macs aren't UNIX FOSS devs, rather devs that care about Apple platform.

My experience has been the opposite. Of all the people I've worked with using Macs, all of them were developing cross-platform open source software. I've yet to meet a single developer making MacOS applications.