Live data from Hacker News

How the Zoom macOS installer does its job without you clicking ‘install’

twitter.com

251–260 of 334 posts

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#251
post #249

Earlier quoted context omitted.

Ok this is it... I was able to disinstall it with $ brew cask install zoomus $ brew cask uninstall zoomus so long and thank you for all the fish... Zoom

You can also use “brew cask zap zoomus” to remove preference files, browser plugins, logs.

Does this also work for non-brew installs?

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#252
I understand wanting to reduce friction, but this is the second time Zoom has kinda done something weird and suspect security wise in the name of removing really minor obstacles that users are probably used to dealing with anyway. Considering how many tech companies are using Zoom right now, I would hope they are cognizant that they don't become known as "the company that does sketchy stuff so our IT people say we can't use it"

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#253
post #240

Earlier quoted context omitted.

Best zoom alternative?

Jitsi, Google Meet, bigbluebutton -- anything can runs in a browser tab and is more or less confined within it.

Don't know bigbluebutton but at least among Jitsi and Google Meet, Wire is an alternative that is open source and end to end encrypted. They just don't make it easy to host your own, for that I guess Jitsi is the best way to go.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#254

I think this also shows how macOS has been training users to enter their password in random dialogs that have absolutely nothing that identifies them as being legit OS dialogs. The dialog that Zoom uses could very well be sending the credentials to a remote server, and the user would be none the wiser.

One could say the same for gksudo, UAC prompts, or the equivalent dialog on your favorite operating system, no? Or is there something on other OSes that identifies it?

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#255
post #246

Earlier quoted context omitted.

sunova.... I couldn't find the web based version...That's what frustrated me about zoom compared to webex. I could use Weber in the browser and zoom had to be installed

It's gated behind a fallback after three "failed" attempts at clicking on the link to open the app after opening a meeting URL, or a meeting setting. So, not on by default, seems to be unable to join audio unless you use Chrome, and shows a single video only.

This browser extension enables the web interface: https://github.com/arkadiyt/zoom-redirector

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#256
post #176

Earlier quoted context omitted.

In fact, if you change URL from /j/CONFERENCE_NUMBER to /wc/join/CONFERENCE_NUMBER you won't be needing to wait for that link.

There is also a browser plugin a saw floating by a couple of days ago that would just enforce this step, but can't find it anymore.

From another commenter on another HN thread https://github.com/arkadiyt/zoom-redirector

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#257

Zoom's got a tradition of being, let's put it like this, way too clever for everyone's own good. See previous “lets install a server on this Mac that is not removed when you uninstall the app and leaves your camera open to the entire internet” for more examples. I use it on a VM, I suggest you do it too.

Best zoom alternative?

Google Duo have raised the people per meeting from 4 to 12.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#258
post #254

I think this also shows how macOS has been training users to enter their password in random dialogs that have absolutely nothing that identifies them as being legit OS dialogs. The dialog that Zoom uses could very well be sending the credentials to a remote server, and the user would be none the wiser.

One could say the same for gksudo, UAC prompts, or the equivalent dialog on your favorite operating system, no? Or is there something on other OSes that identifies it?

gksudo and UAC don't let the process lie about what it is.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#259
post #251
post #249

Earlier quoted context omitted.

You can also use “brew cask zap zoomus” to remove preference files, browser plugins, logs.

Does this also work for non-brew installs?

Homebrew Cask's uninstall scripts are basically a community-maintained "best guess" at to how to full uninstall each piece of software. It's generally pretty reliable, and I do use it to remove non-brew installs sometimes.

Note: I have contributed casks to Homebrew Cask before.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#260

1) If Zoom can do this then it's a MacOS security bug. 2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI. 3) Malware is defined by what it does, not how it's installed.

> 3) Malware is defined by what it does, not how it's installed. Well, from the tweet thread: > If the App is already installed but the current user is not admin, they use a helper tool called "zoomAutenticationTool" [sic] and the AuthorizationExecuteWithPrivileges API to spawn a password prompt identifying as "System" (!!) to gain root (including a typo).

It's not malicious, and you have to give it permissions somehow to finish the install.

Dropbox (used to?) patch system files to integrate with Office better, and that wasn't considered malware either.

Post reply on HN