Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the Zoom macOS installer does its job without you clicking ‘install’

twitter.com

Post reply on HN
Print view View original

121–130 of 334 posts

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#121

Post by bruckie »

ilikehurdles wrote: post #31
t0mas88 wrote: post #10

Earlier quoted context omitted.

I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?

Don’t Google and Microsoft answers both require accounts, and carry with them the expectation that everything you do on their platforms is recorded for the purpose of selling ads? Also I regularly attend more than 50-person zoom calls without a hiccup. Google I think requires an enterprise plan to get to that limit, and I don’t even know what the name of their video conferencing product is at this point.

> Don’t Google and Microsoft answers both require accounts, and carry with them the expectation that everything you do on their platforms is recorded for the purpose of selling ads?

For Google, the answers are "sorta but not really", and "no":

https://support.google.com/meet/answer/9303164: "Note: Guests on the web don't need a Google account to participate in a meeting." The initiator of a meeting needs a G Suite account, but others can join without one.

https://gsuite.google.com/learn-more/security/security-white...: "Google does not collect, scan or use data in G Suite Core Services for advertising purposes."

(Speaking for myself, not Google.)

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#122

Post by aembleton »

ForHackernews wrote: post #83
mikorym wrote: post #74

Earlier quoted context omitted.

I think you underappreciate one point here: We can still have long term alternatives to Zoom (and we can have them now). Google and Uber are already difficult to replace or to otherwise challange.

Uber is trivially easy to replace with Lyft or $generic-taxi-app.

How do you persuade enough taxi drivers to use $generic-taxi-app in enough areas to make it worthwhile for someone to choose to use it instead of Uber?

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#123

Post by xenophonf »

oefrha wrote: post #47
xenophonf wrote: post #28

I missed the part where Zoom is holding people's computers for ransom, or formatting the drive, or exfiltrating sensitive information to criminals or state intelligence officers, or mining bitcoin, or other similarly malicious behaviors. An admin can write to /Applications without privilege escalation? That's a macOS bug. If the operating system didn't rely on an 80s-style put-all-the-executables-in-one-place app lau…

> An admin can write to /Applications without privilege escalation? That's a macOS bug. /Applications has been root:admin 775 since forever ago. It’s not a bug, and drag this app to (an alias of) /Applications is very standard behavior of dmg installers. Working as designed.

That behavior goes all the way back to Classic Mac OS. If the above is working as designed, then Zoom automating the copy-app-to-/Applications process doesn't really seem that hinky to me.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#124

Post by bruckie »

manigandham wrote: post #88
swiley wrote: post #50

Earlier quoted context omitted.

This still isn’t a good reason to build a native app instead of just using webrtc. Someone should make a PSA site that says something along the lines of “don’t install teleconferencing software because it usually bundles malware; your browser already has the technology built in.”

What do you mean by "bundles malware"? What else is it doing besides teleconferencing?

https://daringfireball.net/2020/03/regarding_zoom

https://medium.com/bugbountywriteup/zoom-zero-day-4-million-...

https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-s...

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#125

Post by xenophonf »

rainforest wrote: post #35
xenophonf wrote: post #28

I missed the part where Zoom is holding people's computers for ransom, or formatting the drive, or exfiltrating sensitive information to criminals or state intelligence officers, or mining bitcoin, or other similarly malicious behaviors. An admin can write to /Applications without privilege escalation? That's a macOS bug. If the operating system didn't rely on an 80s-style put-all-the-executables-in-one-place app lau…

> So yeah, Zoom is (ab)using flaws in macOS to get itself installed with minimum fuss, but it isn't doing it with evil intent. But... why? What other software vendors look at the OS security model from a viewpoint of 'how do we bypass this as much as possible?' If it's not evil intent, what is it, incompetence?

/Applications is writable by admins. There is no O/S security model to bypass.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#126

Post by oefrha »

xenophonf wrote: post #123
oefrha wrote: post #47

Earlier quoted context omitted.

> An admin can write to /Applications without privilege escalation? That's a macOS bug. /Applications has been root:admin 775 since forever ago. It’s not a bug, and drag this app to (an alias of) /Applications is very standard behavior of dmg installers. Working as designed.

That behavior goes all the way back to Classic Mac OS. If the above is working as designed, then Zoom automating the copy-app-to-/Applications process doesn't really seem that hinky to me.

It’s a weird thing to do, but I don’t find it particularly concerning, no. You launched the installer after all. (I do use Suspicious Package to quicklook pkgs myself, FWIW.)

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#127

Post by bruckie »

fiddlerwoaroof wrote: post #112
chadlavi wrote: post #57

Earlier quoted context omitted.

Zoom would "just work" if they didn't force you to install software on your computer in the first place. If google meet can do it, zoom can too.

Doesn’t Google Meet depend on a browser plugin they make you install the first time? Hangouts did.

No, it uses WebRTC. https://support.google.com/meet/answer/7317473

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#128

Post by m0dest »

gwbas1c wrote: post #53
aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

Good point, but: You can do so much in a browser now. Does teleconference software really need an installed client anymore?

For better or for worse, WebRTC is very opinionated about codecs and transports. Those might be great choices for some scenarios, but no developer wants their whole business to be constrained it.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#129

Post by rwmj »

t0mas88 wrote: post #2

The whole torrent of grey area, just over the line and outright shady behavior at Zoom is a problem in itself even if all the separate instances in isolation aren't grounds to stop using them. Their responses to security issues and today's revelation of misleading marketing on E2E encryption make it clear they're not just making isolated mistakes. Shady is at the core of how they operate, this is an indication that Z…

They probably learned a lesson from Whatsapp which was a nightmare of insecurity in the early days that cutting corners gets results and approximately no one cares (except the tiny minority like us who would never use it anyway).

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#130

Post by deelowe »

ilikehurdles wrote: post #31
t0mas88 wrote: post #10

Earlier quoted context omitted.

I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?

Don’t Google and Microsoft answers both require accounts, and carry with them the expectation that everything you do on their platforms is recorded for the purpose of selling ads? Also I regularly attend more than 50-person zoom calls without a hiccup. Google I think requires an enterprise plan to get to that limit, and I don’t even know what the name of their video conferencing product is at this point.

I don't think either of those are true for meet.
Post reply on HN