Why isn't this categorized a major Mac OS vulnerability? If Zoom abuses preinstall scripts, what's to say others aren't.
[deleted]
How the Zoom macOS installer does its job without you clicking ‘install’
111–120 of 334 posts
Re: How the Zoom macOS installer does its job without you clicking ‘install’
#112Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…
Zoom would "just work" if they didn't force you to install software on your computer in the first place. If google meet can do it, zoom can too.
Doesn’t Google Meet depend on a browser plugin they make you install the first time? Hangouts did.
Re: How the Zoom macOS installer does its job without you clicking ‘install’
#113Earlier quoted context omitted.
The script asks for root which subsequently pops up an OS password prompt. Zoom never sees your password. How is this different from the way e.g. Virtualbox gets root?
It's not making the proper privilege escalation call, it's faking the box entirely. There's even a typo in the dialog box.
...are you sure? I'm pretty sure that code just pops up the system box to get privileges, with a custom message at the top.
I'm running Mavericks—the last version of macOS before they made the UI flat—and the prompt didn't look out of place. If Zoom is indeed faking the box, they actually went through the trouble to make a separate version for Mavericks with Mavericks-style visuals.
Re: How the Zoom macOS installer does its job without you clicking ‘install’
#1141) If Zoom can do this then it's a MacOS security bug. 2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI. 3) Malware is defined by what it does, not how it's installed.
I mean, it's not really a security bug. Installer.app displays a dialog box that says "Hey, this package wants to run arbitrary code to check if it's compatible with your system. Is that OK?" The user is explicitly opting into the code execution. Zoom's "compatibility check" installs the app and kills the installer window. That's certainly unexpected behavior, but I don't think it's an exploit in any real sense.
While normally I'd object to running arbitrary code with just an easily-skippable dialog as confirmation, but I think it's OK in this case where the expectation was that we're installing their software anyway.
Re: How the Zoom macOS installer does its job without you clicking ‘install’
#115Earlier quoted context omitted.
I think you underappreciate one point here: We can still have long term alternatives to Zoom (and we can have them now). Google and Uber are already difficult to replace or to otherwise challange.
Uber is trivially easy to replace with Lyft or $generic-taxi-app.
Lyft only operates in US and Canada. Uber is available in 63 countries. The convenience you get just having that one Uber app work is not easily replaced. But yeah you could always try to find the local ride sharing companies app, but it can be far less convenient.
Re: How the Zoom macOS installer does its job without you clicking ‘install’
#116Earlier quoted context omitted.
I'm a college professor, and I'll share my perspective. For one, Zoom did just work. (At least as a participant, rather than an organizer.) I tried it out, and it immediately worked. It did what all of us were expecting, with no fuss. I also tried MS Teams. It seems designed with a different philosophy: that you use the software to do many different things, and you want them all integrated. (For example, it posted my…
You're right, MS Teams is definitly better placed as an org-wide communication/collaboration tool, not an external one. They really need to make it easier to communicate with people in external orgs, the org switcher is my biggest complaint. FWIW, IT can allow people in certain groups to make their own teams, it's an admin setting.
Working within the US NIH, we are forced to submit a ticket for creating any new teams and the entire Teams/Office 365 ecosystem is entirely crippled for us. All new features take forever to be approved and brought online, as well as additional connectors and apps having to go through an extensive 6+ month-long vetting process before being approved.
Makes using Teams quite a hassle, but with Skype for Business being the only other approved option for internal chat, it's better than nothing.
Re: How the Zoom macOS installer does its job without you clicking ‘install’
#117For those calling this a security vulnerability in MacOS, isn't this just using a GUI equivalent of "sudo"? There may be a decent argument that a consumer OS shouldn't offer such a sudo-like API to installers, but MacOS probably does this for legacy app support reasons.
IMO the better question in this case is why Zoom needs to be installed as admin on MacOS? After all, the mobile apps and chrome extension don't need those privileges.
Re: How the Zoom macOS installer does its job without you clicking ‘install’
#118Also, Zoom's entire engineering team is based in China [1]. China and Chinese companies have no real culture of user centric privacy.
[1] https://news.ycombinator.com/item?id=22707528
Edit: Why downvote me? I am not trying to stir up flame wars. Saying anything against China has become impossible to do on HN. Voices get drowned despite of raising real legitimate concerns about privacy, especially for a tool used by millions all of a sudden during this pandemic. People should be speaking up on HN. I know, I am not supposed to complain about downvotes on HN, I've read the guidelines.
Edit2: Not able to find the source for Tianjin datacenter, I will reply if I can find it. Please take it with a grain of salt.
Edit3: Holyshit, so much attention on my comment. Redacting unsubstantiated claims and adding more sources that can be traced on the wikipedia section of Zoom privacy criticisms: https://en.wikipedia.org/wiki/Zoom_Video_Communications#Crit...
Re: How the Zoom macOS installer does its job without you clicking ‘install’
#119Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…
I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?
> While Google and Microsoft both offer a product that "just works" with only a browser.
But those products don't always "just work", at least not in my recent experience. I have had repeated problems with Google meetings while working with an external entity, and most of my employer is a Microsoft shop, so I've had deal with issues with both Teams and Skype, both via browser and OS X app.
Re: How the Zoom macOS installer does its job without you clicking ‘install’
#120Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…
It just amazes me that the "just works" solution here is still a native app. Plenty of reasons to use native apps but in 2020 video conferencing really isn't one: WebRTC is capable and supported by every major desktop and mobile browser. It's literally one click and you're done!