Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the Zoom macOS installer does its job without you clicking ‘install’

twitter.com

Post reply on HN
Print view View original

91–100 of 334 posts

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#91

Post by Wowfunhappy »

drampelt wrote: post #77
microtonal wrote: post #27

Earlier quoted context omitted.

I never understood why Apple still supports the pkg format. It seems a half-baked leftover from the 2000s and even then I was already surprised that there is no way to uninstall things through the macOS GUI. I am not sure if this has changed (I try to avoid pkg files and use Homebrew cask to uninstall such packages), but IIRC you had to list the files with pkgutil on the command-line, remove stuff by hand and then --…

> Everything should just be drag to install, drag to trash to remove. I wish it were that easy, most apps leave files in other places on your computer like ~/Library that will never get cleaned up if you just move the app to trash.

As much as this bothers me because of who I am, I don't think it's a real problem. Those files shouldn't take up significant space unless the developer is doing something stupid.

It might be nice if macOS had some sort of automatic cleanup routine when an app is trashed, but that would either require showing the user an extra dialog (a la AppCleaner's) or introducing an opaque system which could potentially lead to data loss.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#92

Post by milesskorpen »

jeroenhd wrote: post #89

As someone who's never used or seen Zoom in action, what's pulling people into Zoom that's not already available in other tools (Hangouts Meet, MS Teams) and even works without installing anything (such as Jitsi)? Based on what I've seen, there's just so much hostile behaviour by the company (including lying about meeting HIPAA e2e requirements!) and the fact that their _official client_ had parts removed by the macO…

I use Meet at work. For social gatherings, my friend group exclusively uses Zoom because (a) better tiling (seems small, but you want to see everyone) and (b) video quality seems better.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#93

Post by lonelappde »

Wowfunhappy wrote: post #14
lultimouomo wrote: post #3

I think this also shows how macOS has been training users to enter their password in random dialogs that have absolutely nothing that identifies them as being legit OS dialogs. The dialog that Zoom uses could very well be sending the credentials to a remote server, and the user would be none the wiser.

Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.

Incorrect. Look at the second tweet in the thread. It's a phishing popup that misidentifies itself in order to steal priveleges intended for System, not Zoom.

https://mobile.twitter.com/c1truz_/status/124473767519161958...

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#94

Post by jtvjan »

wodenokoto wrote: post #54

Having never installed Zoom, and honestly not having photographic memory of how the installation process on MacOS is, how is it supposed to look in the installer? Also, what happened to just dragging the program into the applications folder? I really liked that way of installing apps, but most things seems to have an annoying click-through wizard.

They embedded their installation into a pre-install script. Normally, you'd go through a next-next-next process with a pkg installer, but in this case you get a popup asking you if you want to allow it to "run a program to determine if the software can be installed" (the purpose of pre-install scripts) immediately after opening the pkg, you authenticate, and then the installer just disappears.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#95

Post by e40 »

I can't imagine why anyone logs in and uses macOS as an admin user.

First account I create on a new Mac: admin. Then, when setup is done, I login and create my non-admin user account.

This is a good reason for many reasons, this abusive installer being one.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#96

Post by lonelappde »

Wowfunhappy wrote: post #64
tantalor wrote: post #21

Earlier quoted context omitted.

It doesn't look legit, it looks like the installer script is faking a system dialog in this screenshot: https://twitter.com/c1truz_/status/1244737675191619584/photo... This message is a lie; it not coming from system but from the installer script. Just because the OS is used to show the dialog doesn't mean it should be trusted. As other commenter noted this could be used to steal passwords; that is effectively what i…

The script asks for root which subsequently pops up an OS password prompt. Zoom never sees your password. How is this different from the way e.g. Virtualbox gets root?

Because it lies about its identity, calling itself "System" not Zoom.

This is also a MacOS vuln that lets apps lie about their identity in sudo prompts, much like a browser showing an https site with no certificate checking.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#97

Post by lonelappde »

factorialboy wrote: post #19

Why isn't this categorized a major Mac OS vulnerability? If Zoom abuses preinstall scripts, what's to say others aren't.

It's not a vulnerability, as the dialog says "run a program" and prompts for confirmation.

It's up to the user's imagination to consider what a program can do.

The prompt is terribly worded though.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#98

Post by lonelappde »

aequitas wrote: post #71
paulgpetty wrote: post #18

Two questions this raises, for me at least: How do I know I’ve completely uninstalled all the things Zoom installed? And, if Zoom provided a separate uninstaller (like many apps do) and it was verified to purge all of the stuff they installed (along with the uninstaller); would that appease people's concerns? For now I’m sticking with the iOS app for video & their web-based experience for desktop sharing...

I think it's interesting to see the outcry when Apple poses new restrictions in the application distribution process (like signing and sandboxing) but conversely the same cries go up when there is an App that seems to be abusing loose control mechanisms. I think a lot of power users rightfully feel they are belittled by sandboxes and application restrictions. But seeing that they are not the major userbase and most A…

It's possible to things wrong in more than one way.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#99

Post by lonelappde »

javagram wrote: post #38
rainforest wrote: post #35

Earlier quoted context omitted.

> So yeah, Zoom is (ab)using flaws in macOS to get itself installed with minimum fuss, but it isn't doing it with evil intent. But... why? What other software vendors look at the OS security model from a viewpoint of 'how do we bypass this as much as possible?' If it's not evil intent, what is it, incompetence?

It’s about making your software as easy to use as possible. Users don’t like UAC or having to click through a dozen dialogs. They just want to get into their virtual meeting.

Zoom could be honest about what it doing instead of going to extreme lengths to conceal it

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#100

Post by xorcist »

j1elo wrote: post #86

Some background info for those commenters who say that Zoom should be requiring just a web browser because web browsers already have everything needed (aka. WebRTC). TL;DR summary: they want to do their own thing, outside of what the WebRTC standard allows, that's all (and enough reason for not using WebRTC?) Zoom doesn't want to use the stock H.264 encoder as provided by the browser for WebRTC communication. Instead…

Right. It's also important to understand when the reason to build non-standard things are just "productization" (intended to open the wallets of enterprise clients) and when it is because it really provides a better service to the end user.

Having native code running in every client makes a service provider more valuable. It is much the same reason service providers would rather have you running their app on mobile than utilizing the web browser.

This link provides a bit of background to the webrtchack articles above and give a bit of background to when WebRTC is sufficient:

https://bloggeek.me/webrtc-vs-zoom-video-quality/

Post reply on HN