How the Zoom macOS installer does its job without you clicking ‘install’ • Hacker News Board

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#41

Post by javagram » Tue, Mar 31, 2020, 1:17 PM UTC

microtonal wrote: post #27

Wowfunhappy wrote: post #14

Earlier quoted context omitted.

Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.

I never understood why Apple still supports the pkg format. It seems a half-baked leftover from the 2000s and even then I was already surprised that there is no way to uninstall things through the macOS GUI. I am not sure if this has changed (I try to avoid pkg files and use Homebrew cask to uninstall such packages), but IIRC you had to list the files with pkgutil on the command-line, remove stuff by hand and then --…

In my experience I’ve seen even technical users (Who were used to windows) struggle with the idea of dragging an .app from an open disk image to the Applications folder. They would end up running the app from the disk image and then getting confused when it disappears after restart.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#42

Post by my123 » Tue, Mar 31, 2020, 1:18 PM UTC

javagram wrote: post #38

rainforest wrote: post #35

Earlier quoted context omitted.

> So yeah, Zoom is (ab)using flaws in macOS to get itself installed with minimum fuss, but it isn't doing it with evil intent. But... why? What other software vendors look at the OS security model from a viewpoint of 'how do we bypass this as much as possible?' If it's not evil intent, what is it, incompetence?

It’s about making your software as easy to use as possible. Users don’t like UAC or having to click through a dozen dialogs. They just want to get into their virtual meeting.

Then Zoom should just make them join the meeting via the web browser!

Zoom does this somehow and doesn't make joining from the web frictionless when they pretty much could have.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#43

Post by my123 » Tue, Mar 31, 2020, 1:22 PM UTC

dceddia wrote: post #11

dbbk wrote: post #5

But why are they doing this? What is the benefit?

If I had to guess, it’s an attempt to optimize install conversions. Every multi-step process you ask a user to perform is effectively a (marketing/sales) funnel. Some percentage of people drop off at every step. Maybe Zoom they thought that if they moved the actual installation closer to Step 1, then more people would accomplish it. It’s awfully sneaky though, especially that password dialog.

They could have made it just a zip containing an app bundle instead of this mess, but of course they didn't.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#44

Post by impendia » Tue, Mar 31, 2020, 1:22 PM UTC

t0mas88 wrote: post #10

aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?

I'm a college professor, and I'll share my perspective.

For one, Zoom did just work. (At least as a participant, rather than an organizer.) I tried it out, and it immediately worked. It did what all of us were expecting, with no fuss.

I also tried MS Teams. It seems designed with a different philosophy: that you use the software to do many different things, and you want them all integrated. (For example, it posted my meetings automatically to my Outlook calendar. I had never used this calendar before, and was only dimly aware that it existed.)

Moreover, it seems that the expected setup is a bunch of people, all at the same workplace, who communicate with each other consistently. My needs are different, with wildly disparate use cases: a departmental meeting; classes to teach; an online conference (https://www.daniellitt.com/agonize/); an online social gathering. Many of the people with whom I communicate don't work for the same employer. And I don't want to configure all of these "teams" in advance.

That said, I tried to get MS Teams up and running, to teach my class. This involved multiple emails back and forth to our tech support (it seems that I can't set up a "team" myself; I have to ask IT to do it for me). It didn't have its own whiteboard functionality so I had to download and run some separate software.

And, then, in the end... it didn't work. I was trying to teach a class, but my students couldn't see what I was doing. I had no idea why.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#45

Post by RocketSyntax » Tue, Mar 31, 2020, 1:24 PM UTC

Okay, great. Let's wrap some permissions around it to make this a legit process?

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#46

Post by reaperducer » Tue, Mar 31, 2020, 1:27 PM UTC

lukevp wrote: post #32

aequitas wrote: post #26

Earlier quoted context omitted.

We just had a corporate presentation with around 250 people. Normally we use Teams or Slack for internal communication, this was also stated by management, that Zoom should only be used for 'big' meetings like this. I think they know the other solutions will not work as well for bigger groups. I've not had issues with using either solution for small group meetings. Actually I have to go out of my way to run Zoom in t…

Why not use Teams Live for this? We have been using zoom and Teams alternately and Teams performance and ease of use has been much better in my experience, but we have yet to do a 200+ all hands so I was curious if there were some footguns with teams live that you may know about. Teams live works on a lot of platforms and also has a web version.

Why not use Teams Live for this?

My wife was on a Teams videoconference last week. 125 people in four locations from New York to Southern California.

An hour into it, half of the people were simultaneously dropped, and not from any particular geography. It was random. And nobody could reconnect for a very long time. It took 45 minutes to restart the meeting.

The company is no longer using Teams.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#47

Post by oefrha » Tue, Mar 31, 2020, 1:28 PM UTC

xenophonf wrote: post #28

I missed the part where Zoom is holding people's computers for ransom, or formatting the drive, or exfiltrating sensitive information to criminals or state intelligence officers, or mining bitcoin, or other similarly malicious behaviors. An admin can write to /Applications without privilege escalation? That's a macOS bug. If the operating system didn't rely on an 80s-style put-all-the-executables-in-one-place app lau…

> An admin can write to /Applications without privilege escalation? That's a macOS bug.

/Applications has been root:admin 775 since forever ago. It’s not a bug, and drag this app to (an alias of) /Applications is very standard behavior of dmg installers. Working as designed.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#48

Post by swiley » Tue, Mar 31, 2020, 1:30 PM UTC

tantalor wrote: post #40

rainforest wrote: post #39

Earlier quoted context omitted.

To their credit, they seem to be using AuthorizationExecuteWithPrivileges which doesn't get the user's password, but executes a command as root, which is marginally better than stealing the password like Dropbox did.

How hard do you think it is to steal a password once you have root?

It would take an extra step, you have access to the hash and maybe shared memory/SOs but you’d need a second trick to actually steal it.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#49

Post by tarsinge » Tue, Mar 31, 2020, 1:33 PM UTC

aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

This is/was maybe true on Windows but on macOS installing an App the standard way is straightforward and any user knows how to do it.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#50

Post by swiley » Tue, Mar 31, 2020, 1:33 PM UTC

aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

This still isn’t a good reason to build a native app instead of just using webrtc.

Someone should make a PSA site that says something along the lines of “don’t install teleconferencing software because it usually bundles malware; your browser already has the technology built in.”