Live data from Hacker News

Apple has pushed a silent Mac update to remove hidden Zoom web server

techcrunch.com

501–510 of 552 posts

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#501

Earlier quoted context omitted.

As nice as that sounds, I think it requires an impossibly perfect prediction of future events. You face ethical decisions whenever you have power or limited resources.

No. You can bend your business model towards transactions you are comfortable with, without perfect future vision, or even a clear strategic understanding of how that might happen. In fact, the world around you will bend to meet your values whether you’re even aware of it. And that includes any companies you run. The world does extend beyond your knowledge of it.

You really need to build a company that values that right down to its core. It has to be embedded so deep into the hiring process that you only select for people who share that value, and it has to be easy to let go of people who don’t fit.

Otherwise, it only takes one person to short-circuit that value to set the ball rolling on a shift towards lower standards.

You need to run a super tight ship, which I think is not as hard as it sounds until you put VC, investment, and shareholders into the mix. You at least need to be super diligent about those people you bring in who are not accountable to you, but you are accountable to them.

Basecamp is an amazing example of a company that has succeeded without compromising itself a jot. They do all kinds of things that we might consider unthinkable because they won’t budge on their values. Probably the one company I’d drop everything to work for if I had a chance at getting through their hiring process.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#502
post #13

If you would like to force this update you can do so via the terminal: softwareupdate -ia --include-config-data It will show up as MRTConfigData if you look under Apple Menu->About This Mac->System Report->Software->Installations. The latest version is 1.45 and was updated today which includes the Zoom mitigations.

This also install a lot of stuff people may not want to. You can install only the designated package with : softwareupdate -i MRTConfigData_10_14-1.45 --include-config-data

What updates would people not want to install? Just curious, not arguing.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#503

Earlier quoted context omitted.

The problem is that Apple appears to have made an exception to its own rules in this particular case. If I understand correctly, they used a first party system update mechanism to change third party software. It's like Google making an ad hoc decision to use Chrome autoupdate to silently patch a particularly bad vulnerability in Microsoft Word just because they can. So what is the principle behind this kind of except…

This is untrue. The update process was part of Xprotect, the malware definition/signature system built-into macOS that's part of Gatekeeper [1]. It dates back to Mac OS X 10.5 Leopard and was expanded on Mac OS X 10.6 Snow Leopard (the Gatekeeper GUI was introduced in OS X 10.8 Mountain Lion and back ported to Mac OS X 10.7.5 Lion). Updates were historically issued via minor OS updates, but Apple started to do silent…

I understand why Apple did it and the additional context you provide does change my opinion somewhat in Apple's favor, but I disagree about Zoom being malware because malware is made in bad faith to introduce functionality the user never intended to use.

What Zoom did was negligent and incompetent, but I don't see that there was malicious intent. I do agree, however, that what they tried to do is unacceptable even if implemented competently.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#504

Earlier quoted context omitted.

This also install a lot of stuff people may not want to. You can install only the designated package with : softwareupdate -i MRTConfigData_10_14-1.45 --include-config-data

Software Update Tool MRTConfigData_10_14-1.45: No such update No updates are available.

Use

    softwareupdate -l --include-config-data
To list available updates, then adjust the command with the MRTConfigData version Apple provides for you.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#505

Earlier quoted context omitted.

lol they removed what would be called horrific spyware if it wasn’t made by Zoom and you’re over here on some lofty criticism about possible implications years into the future any OS (and many other apps) that update have the power to do what you’re afraid of, and much more. plus i don’t really see a bright line between system level software and an app when apps can access your video cam, mic, all your files - basica…

any OS (and many other apps) that update have the power to do what you’re afraid of, and much more. There's an ocean of difference between can and will . plus i don’t really see a bright line between system level software and an app when apps can access your video cam, mic, all your files - basically your whole computer. The setting ostensibly refers to the operating system , i.e. macOS, which I have no problems with…

They didn't remove the application. They removed the mechanism by which that application was circumventing user intervention (which does actually remove the application). It's almost like a company refusing to take chinless credit cards to stop fake credit card use. They didn't do anything to the credit cards themselves to make the valid ones invalid. They just updated their policies to exclude the ones that could be abused.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#506
post #13

If you would like to force this update you can do so via the terminal: softwareupdate -ia --include-config-data It will show up as MRTConfigData if you look under Apple Menu->About This Mac->System Report->Software->Installations. The latest version is 1.45 and was updated today which includes the Zoom mitigations.

softwareupdate --history --all | grep MRT

MRTConfigData 1.45 2019-07-11, 13:10:59 softwareupdated

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#507
post #399
post #391

Earlier quoted context omitted.

But they didn't uninstall 'a program'. The product itself was unaffected. And, again, this was done in consultation with the makers of the 'program' who had screwed up badly enough to be unable to fix the problem themselves. Nothing happened here that doesn't regularly happen when all sorts of things update.

These are unimportant details, the issue is with Apple modifying people's computers silently and the users themselves having no knowledge or any say about it. Replace this instance with something that you disagree about (imagine Apple removing VPN software from Chinese customers due to demands from China or "fixing" existing VPN software with backdoors that enable Chinese authorities to wiretap Chinese people) and se…

>the users themselves having no knowledge or any say about it.

This is not true. You can disable all the automatic updates in System Preferences.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#508
post #388
post #386

Earlier quoted context omitted.

I still have a lot of trouble seeing how Apple removing a critical vulnerability - a completely mundane act with plenty of precedent from both Apple and others - is some clarion call that, if left unheeded, will have Siri judging everyone's hentai collection next. Why this - preventing myriads of users from becoming campeople - of all things? Why not, say, every Chrome autoupdate ever?

> I still have a lot of trouble seeing how Apple removing a critical vulnerability You have that trouble because you are focusing on the "critical vulnerability" part and ignoring the fact that Apple decided to uninstall a program they had nothing to do with from your computer without your consent. The intentions might be noble, the implications however are less so.

>uninstall a program they had nothing to do with from your computer without your consent.

Incorrect. Users who are vulnerable to this had already decided to uninstall Zoom and that's why it was a vulnerability. Zoom had decided to ignore the user's wishes and leave their server behind so that it could re-install the software. Apple's update simply enforces the users' past decision to uninstall the application.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#509

Earlier quoted context omitted.

This also install a lot of stuff people may not want to. You can install only the designated package with : softwareupdate -i MRTConfigData_10_14-1.45 --include-config-data

What updates would people not want to install? Just curious, not arguing.

I like to precisely know what's installed and running on my devices. It does not make sense to install latest HP printer software, or new Apple Pro Codecs, to patch a particular security flaw related to Zoom.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#510

Earlier quoted context omitted.

Have you checked ProgramData, Local, and Roaming recently? Or your registry? Also, Add/Remove only works if the program adds itself there. And remove only works if the program added an uninstaller. Also, even then, it still leaves crap behind.

At least there is a convention to have an uninstaller. If you create the installer through conventional toolboxes the uninstaller comes for free. That's how most Windows programs have both.

macOS has the same convention. Conventional toolboxes are mostly not-Windows and not-Microsoft toolboxes, indicating that even if it's a convention, it'a apparently not a windows-native convention.
Post reply on HN