Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the Zoom macOS installer does its job without you clicking ‘install’

twitter.com

Post reply on HN
Print view View original

141–150 of 334 posts

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#141

Post by manigandham »

Gaelan wrote: post #114
manigandham wrote: post #85

1) If Zoom can do this then it's a MacOS security bug. 2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI. 3) Malware is defined by what it does, not how it's installed.

I mean, it's not really a security bug. Installer.app displays a dialog box that says "Hey, this package wants to run arbitrary code to check if it's compatible with your system. Is that OK?" The user is explicitly opting into the code execution. Zoom's "compatibility check" installs the app and kills the installer window. That's certainly unexpected behavior, but I don't think it's an exploit in any real sense. Whil…

You're right, it's more of a design issue. More explicit permissions on altering the Applications folder could help. Then again, most people want an easier install so this is really for those who want that extra control.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#142

Post by x0x0 »

xorcist wrote: post #109
dceddia wrote: post #11

Earlier quoted context omitted.

If I had to guess, it’s an attempt to optimize install conversions. Every multi-step process you ask a user to perform is effectively a (marketing/sales) funnel. Some percentage of people drop off at every step. Maybe Zoom they thought that if they moved the actual installation closer to Step 1, then more people would accomplish it. It’s awfully sneaky though, especially that password dialog.

> it’s an attempt to optimize install conversions I love creative uses of language like this! Be right back, I just have to optimize install conversions of my botnet client.

Or, you know, decrease the failure rate of people legitimately attempting to install Zoom. It's quite reasonable to ask why on earth apple requires more than one click for a user to say "I want this program to run on my computer; make it happen."

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#143

Post by Wowfunhappy »

microtonal wrote: post #103
Wowfunhappy wrote: post #80

Earlier quoted context omitted.

Developers can distribute .app's inside of .zip files, and many do, but this can result in users just running the .app inside of their downloads folder. And then this causes problems if they ever decide to clean out their Downloads folder. The DMGs are a clever way to (A) make sure the app gets to the proper location while simultaneously (B) teaching the user about what's actually happening on their computer. As I sa…

Developers can distribute .app's inside of .zip files, and many do, but this can result in users just running the .app inside of their downloads folder. And then this causes problems if they ever decide to clean out their Downloads folder. Some applications offer to move themselves to the /Applications folder when started the first time outside /Applications or ~/Applications . Though in general, it would be better i…

Yeah, and that's a fine solution given the situation Apple has left us in. But it's also kind of a hack, which shouldn't have become necessary.

Also, personally, I sometimes purposefully put apps in places other than /Applications—for example, I like to keep games in their own Games folder. And then the dialogs are kind of annoying.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#144

Post by bwb »

Saaster wrote: post #132
untog wrote: post #120

Earlier quoted context omitted.

It just amazes me that the "just works" solution here is still a native app. Plenty of reasons to use native apps but in 2020 video conferencing really isn't one: WebRTC is capable and supported by every major desktop and mobile browser. It's literally one click and you're done!

None of the WebRTC based options just work, they're all glitchy and cannot scale up to even moderate amounts of users. We have Google Hangouts Meet for free for our org, and we still pay for Zoom because It Just Works.

Same here, we used hangouts for the longest time but it got worse. Zoom just works perfectly all the time.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#145

Post by mrpippy »

rgovostes wrote: post #79

I installed the WebEx client for macOS today and it seemed similar, installing almost instantly without going through the normal EULA, volume selection, etc. flow. It seems like they've stuck their installation flow into an Installer.app _plugin_ which is unusual. I haven't encountered that before, and I'm somewhat surprised the feature exists considering Apple waged war on loading code into first-party software. (Th…

Ughhh, this is probably where Zoom got the idea from.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#146

Post by neuronic »

Fiahil wrote: post #7
capableweb wrote: post #4

Earlier quoted context omitted.

Unfortunately, the current system and people in power seems to not give a damn about security and shady behavior, as long as the thing they are using is working and working well. Zoom is an example of very useful and performant software with shady company behind it, that's why people will continue using it. Same with Uber, Google and bunch of other companies. It doesn't matter what they do, as their product is helpin…

Enterprise customer DO give a damn about security. They can be slow to react, but rules are also there for a very long time. If Zoom doesn't want to loose most of their marketshare in favor of WebEx, they should probably address these issues.

This is hilariously wrong. I brought up Zoom issues at our enterprise client - no one gives a shit (this is in Germany, so rather privacy focused). As a consultant I felt a need to bring the issues up, backed with sources of course.

So why does no one care? Because Zoom UI/UX apparently works 100x better than most other solutions. People dont even REACT when I mentions Jitsi or just using the Teams solution that every Microsoft customer has anyways.

The enterprise I was talking about is using a mix of Microsoft Teams and Zoom. Our team started with Teams, now we are using Zoom because I don't even know. Others also move from Teams to Zoom.

I bring this up to lots of people and the response is rolling eyes and "shut the fuck up" in business euphemisms. Zoom is viral now and privacy has no say in its success.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#147

Post by rainforest »

xenophonf wrote: post #125
rainforest wrote: post #35

Earlier quoted context omitted.

> So yeah, Zoom is (ab)using flaws in macOS to get itself installed with minimum fuss, but it isn't doing it with evil intent. But... why? What other software vendors look at the OS security model from a viewpoint of 'how do we bypass this as much as possible?' If it's not evil intent, what is it, incompetence?

/Applications is writable by admins. There is no O/S security model to bypass.

It has a pre-flight script (which isn't supposed to change anything) that installs it (and its browser extensions, and a kernel extension at some point in the past) in the most widely available place the current user has privileges to (it installs in their home directory if they aren't an admin).

So yes, there is some blame to be laid at the OS for running binaries with the privileges the current user has, but it's clear that the installer doesn't behave like a regular installer would.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#148

Post by alasdair_ »

t0mas88 wrote: post #10
aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?

Google has messenger and hangouts and another video conferencing solution that I don't recall.

The reason we ditched hangouts for zoom a few years ago was that hangouts only supported up to ten users, including users whose connection had died and so they had to re-enter the room again. This became extremely annoying - having to stop a conference mid-call to ask some people to disconnect so others could enter, or trying to find out how to kick "ghost" users, was definitely not "just works".

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#149

Post by lostmsu »

impendia wrote: post #44
t0mas88 wrote: post #10

Earlier quoted context omitted.

I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?

I'm a college professor, and I'll share my perspective. For one, Zoom did just work. (At least as a participant, rather than an organizer.) I tried it out, and it immediately worked. It did what all of us were expecting, with no fuss. I also tried MS Teams. It seems designed with a different philosophy: that you use the software to do many different things, and you want them all integrated. (For example, it posted my…

It does not "just work" for me. First, it required a separate client, when even Skype does not.

Second, it does not support my browser.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#150

Post by kerng »

fermienrico wrote: post #118

Also, Zoom's entire engineering team is based in China [1]. China and Chinese companies have no real culture of user centric privacy. [1] https://news.ycombinator.com/item?id=22707528 Edit: Why downvote me? I am not trying to stir up flame wars. Saying anything against China has become impossible to do on HN. Voices get drowned despite of raising real legitimate concerns about privacy, especially for a tool used by m…

Thanks for sharing. I'm not too concerned about engineering happening in China but data storage seems problematic, especially because of the lack of encryption on their side.

The post or the CNBC link don't seem to have the word Tianjin in them (comments do). Can you provide more details or another source?

If that's indeed true I won't be hopping on a Zoom call later this week with my bank for instance.

Post reply on HN