Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the Zoom macOS installer does its job without you clicking ‘install’

twitter.com

Post reply on HN
Print view View original

131–140 of 334 posts

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#131

Post by SiempreViernes »

aeyes wrote: post #108
jeroenhd wrote: post #89

As someone who's never used or seen Zoom in action, what's pulling people into Zoom that's not already available in other tools (Hangouts Meet, MS Teams) and even works without installing anything (such as Jitsi)? Based on what I've seen, there's just so much hostile behaviour by the company (including lying about meeting HIPAA e2e requirements!) and the fact that their _official client_ had parts removed by the macO…

I use Zoom, Hangouts, Slack and WebEx. Out of those Zoom has the best call quality, and it is the only solution out of the 4 on which huge meetings (50+ persons) are workable.

I've used another software for big meetings, now called Vibe, which works if I close chrome and patiently wait for the bloated java app to expand into all available memory before trying to take any action... it's not great.

Zoom manages to run without crashing doesn't force me to close a browser and waiting a lot, so that's an advantage.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#132

Post by Saaster »

untog wrote: post #120
aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

It just amazes me that the "just works" solution here is still a native app. Plenty of reasons to use native apps but in 2020 video conferencing really isn't one: WebRTC is capable and supported by every major desktop and mobile browser. It's literally one click and you're done!

None of the WebRTC based options just work, they're all glitchy and cannot scale up to even moderate amounts of users. We have Google Hangouts Meet for free for our org, and we still pay for Zoom because It Just Works.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#133

Post by jopolous »

On a simpler level, zoom on macOS sketches me out in lots of ways.

My macbook's bluetooth will not connect to my earbuds, but only when zoom is running. Other audio recording/playing apps don't affect things at all. What the heck is going on here?!

Scrolling on settings panels is definitely their own home-brewed scrolling functionality. Why?! Was macOS's not cutting it for some reason?

The settings menu is very clearly not using native OS buttons and inputs. Why?! Why build your own? What is that for?

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#134

Post by xenophonf »

oefrha wrote: post #126
xenophonf wrote: post #123

Earlier quoted context omitted.

That behavior goes all the way back to Classic Mac OS. If the above is working as designed, then Zoom automating the copy-app-to-/Applications process doesn't really seem that hinky to me.

It’s a weird thing to do, but I don’t find it particularly concerning, no. You launched the installer after all. (I do use Suspicious Package to quicklook pkgs myself, FWIW.)

Having write access without privilege escalation to executable packages run by all users on a multiuser computer is a significant security risk. That's one of the ways an attacker can pivot into other systems from a compromised computer.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#135

Post by ForHackernews »

minhazm wrote: post #115
ForHackernews wrote: post #83

Earlier quoted context omitted.

Uber is trivially easy to replace with Lyft or $generic-taxi-app.

Lyft only operates in US and Canada. Uber is available in 63 countries. The convenience you get just having that one Uber app work is not easily replaced. But yeah you could always try to find the local ride sharing companies app, but it can be far less convenient.

Only a tiny minority of wealthy people frequently travel internationally. This is not a major selling point that will save Uber.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#136

Post by unlinked_dll »

t0mas88 wrote: post #10
aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?

Same question. Not because of the browser thing but just because it doesn't "just work" for me or my team.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#137

Post by oefrha »

xenophonf wrote: post #134
oefrha wrote: post #126

Earlier quoted context omitted.

It’s a weird thing to do, but I don’t find it particularly concerning, no. You launched the installer after all. (I do use Suspicious Package to quicklook pkgs myself, FWIW.)

Having write access without privilege escalation to executable packages run by all users on a multiuser computer is a significant security risk. That's one of the ways an attacker can pivot into other systems from a compromised computer.

root:admin 775 is only writable by the admin group, I’m not sure where you got the idea that all users have write access.

The situation here is an admin explicitly executing a program that writes to a directory that they have write access to.

Edit: corrected typo 755 => 775.

Edit 2: Okay, I read what you wrote again and can now see I misunderstood. However,

1. macOS is primarily single user (or at least single household) given how it's actually used. In actual multiuser settings admins don't typically muck around with their admin account.

2. Typically other users can read/execute a lot of stuff that's not root anyway. For instance, on research group Linux servers people would often tell you to just execute something in their home directory.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#138

Post by x0x0 »

Saaster wrote: post #132
untog wrote: post #120

Earlier quoted context omitted.

It just amazes me that the "just works" solution here is still a native app. Plenty of reasons to use native apps but in 2020 video conferencing really isn't one: WebRTC is capable and supported by every major desktop and mobile browser. It's literally one click and you're done!

None of the WebRTC based options just work, they're all glitchy and cannot scale up to even moderate amounts of users. We have Google Hangouts Meet for free for our org, and we still pay for Zoom because It Just Works.

Yeah. And high fidelity sync between audio (ideally via phone). Maybe someone does it, but we tried _all_ vendors and settled on Zoom. And screen annotations, and the ability to remember participants' phones and dial them directly (replaces them having to type 9 digit numbers into their phones), etc.

Also, Zoom has reached a critical mass where, particularly for sales calls, the remote party is quite likely to have it installed. The network effect here is really valuable.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#139

Post by manigandham »

keymone wrote: post #106
manigandham wrote: post #85

1) If Zoom can do this then it's a MacOS security bug. 2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI. 3) Malware is defined by what it does, not how it's installed.

is botnet agent not malware? it's not doing anything until the operator sends the payload.

A botnet agent is designed to take control and run a bot, so yes it's malware. It doesn't have to be actively doing it at that moment to be considered such.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#140

Post by Lucasoato »

fermienrico wrote: post #118

Also, Zoom's entire engineering team is based in China [1]. China and Chinese companies have no real culture of user centric privacy. [1] https://news.ycombinator.com/item?id=22707528 Edit: Why downvote me? I am not trying to stir up flame wars. Saying anything against China has become impossible to do on HN. Voices get drowned despite of raising real legitimate concerns about privacy, especially for a tool used by m…

totalitarian dictatorship intensifies
Post reply on HN