Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the Zoom macOS installer does its job without you clicking ‘install’

twitter.com

Post reply on HN
Print view View original

221–230 of 334 posts

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#221

Post by JadeNB »

twodayslate wrote: post #172
pehtis wrote: post #87

Earlier quoted context omitted.

I would highly recommend checking all installers on macOS through Suspicious Package. It will give you a complete picture of all the installer scripts that will be run and all the files that will be written. I did just that for zoom and decided against installing it.

https://mothersruin.com/software/SuspiciousPackage/ for those curious

Similar functionality: unpkg (https://www.timdoug.com/unpkg/). See also https://stackoverflow.com/questions/11298855/how-to-unpack-a... . I think unpkg handles mpkg files, which I haven't encountered in the wild for quite a while now; I don't know about the others.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#222

Post by diebeforei485 »

realityking wrote: post #22

I really wish they'd make the client available in the Mac App Store. Not only is the installation experience better than this, things also stay nicely up-to-date. If your company runs an MDM for your Macs, it's easy to deploy apps en-mass to everyone.

It's times like this when I realize how much I prefer the Mac App Store over everything else.

Zoom should definitely offer a Mac App Store version. Even if they just take their iPad app and Catalyst it, I'd probably use it.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#223

Post by junky228 »

ummonk wrote: post #215
tambourine_man wrote: post #173

Zoom's got a tradition of being, let's put it like this, way too clever for everyone's own good. See previous “lets install a server on this Mac that is not removed when you uninstall the app and leaves your camera open to the entire internet” for more examples. I use it on a VM, I suggest you do it too.

I use the web browser version, and refuse to even install Zoom. It's borderline spyware.

sunova.... I couldn't find the web based version...That's what frustrated me about zoom compared to webex. I could use Weber in the browser and zoom had to be installed

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#224

Post by impendia »

gentleman11 wrote: post #202
impendia wrote: post #44

Earlier quoted context omitted.

I'm a college professor, and I'll share my perspective. For one, Zoom did just work. (At least as a participant, rather than an organizer.) I tried it out, and it immediately worked. It did what all of us were expecting, with no fuss. I also tried MS Teams. It seems designed with a different philosophy: that you use the software to do many different things, and you want them all integrated. (For example, it posted my…

Zoom doesn’t just work. If the students want privacy, they are just helpless. Edit: downvoted for speaking up for student rights. Sorry if it is inconvenient for the teachers

> If the students want privacy, they are just helpless.

This isn't true actually. As a student, send the following email:

"Hi Professor, I just read this webpage [link], which outlines some privacy concerns with Zoom. I know some other classes are running Software X, could we try that instead?"

My university isn't mandating Zoom. Indeed, they recommended several software packages, of which their top recommendation was Blackboard. (Which is what I've been using so far. I have mostly joined others' Zoom meetings; I've only initiated them for a D+D game I'm participating in.) MS Teams was their second recommendation as I recall, and Zoom was below that.

At least at my university -- and I expect that this is typical -- individual faculty members are deciding how to best fulfill their own responsibilities. And I have emphasized to my students that I have never done this before, and that I'm happy to change what I'm doing if people have good suggestions.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#225

Post by thaumasiotes »

Wowfunhappy wrote: post #14
lultimouomo wrote: post #3

I think this also shows how macOS has been training users to enter their password in random dialogs that have absolutely nothing that identifies them as being legit OS dialogs. The dialog that Zoom uses could very well be sending the credentials to a remote server, and the user would be none the wiser.

Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.

> Note that in this case, it's still a legit OS dialog.

No it isn't. The dialog prompt is "System need your privilege to change." That's not passing QA anywhere -- it's just a custom message someone put into Zoom without bothering to proofread.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#226

Post by aequitas »

floatingatoll wrote: post #160
lostmsu wrote: post #149

Earlier quoted context omitted.

It does not "just work" for me. First, it required a separate client, when even Skype does not. Second, it does not support my browser.

Your unstated criteria for "just work" are "just work in browser", which differs from the definition used by the comment you're replying to. That is not universally shared among others, including the non-technical folks that Zoom is being widely adopted by.

This is what I was getting at with my parent comment, it "just works" for everyone. But it doesn't fit some of the niches technical or privacy minded people have. And in the end, we are bound by the common denominator. I can push my open source privacy respecting solution all I want. But unless it "just works" for the lowest tech user I'm at a loss.

There's a parallels here with security in the uphill battle to get users to respect the caveats of the solution they choose.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#227

Post by aequitas »

enedil wrote: post #176
aequitas wrote: post #26

Earlier quoted context omitted.

We just had a corporate presentation with around 250 people. Normally we use Teams or Slack for internal communication, this was also stated by management, that Zoom should only be used for 'big' meetings like this. I think they know the other solutions will not work as well for bigger groups. I've not had issues with using either solution for small group meetings. Actually I have to go out of my way to run Zoom in t…

In fact, if you change URL from /j/CONFERENCE_NUMBER to /wc/join/CONFERENCE_NUMBER you won't be needing to wait for that link.

There is also a browser plugin a saw floating by a couple of days ago that would just enforce this step, but can't find it anymore.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#228

Post by munk-a »

manigandham wrote: post #139
keymone wrote: post #106

Earlier quoted context omitted.

is botnet agent not malware? it's not doing anything until the operator sends the payload.

A botnet agent is designed to take control and run a bot, so yes it's malware. It doesn't have to be actively doing it at that moment to be considered such.

Zoom does report usage to Facebook whether you have an account or not - and that data is used to stitch together a web profile of the user that is of no benefit to the user. Zoom is bordering on malware, just... malware that comes with a useful app that allows video conferencing.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#229

Post by aequitas »

distances wrote: post #51
aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

I guess it works for some . I've had two Zoom meetings this far, and in both cases the organizer quickly changed to Jitsi as Zoom had distorted audio. Maybe some incompatible software/hardware at some end? I don't know or even care really, but Jitsi worked well with the same participants both times, while the anecdotal Zoom success rate is still 0% for me.

For meetings I host I'm trying to evaluate Jitsi as well, so far without much luck. I'm not hosting that many meeting and the one I did was with someone using Linux not getting screen sharing working.

But Jitsi is on my shortlist as I think being open source and self-hostable is the way forward for a tool that could knock Zoom of it's throne.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#230

Post by aequitas »

swiley wrote: post #50
aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

This still isn’t a good reason to build a native app instead of just using webrtc. Someone should make a PSA site that says something along the lines of “don’t install teleconferencing software because it usually bundles malware; your browser already has the technology built in.”

It is however the reason why this solution is being used instead of all the other ones.
Post reply on HN