Why does Apple allow this?
How the Zoom macOS installer does its job without you clicking ‘install’
331–334 of 334 posts
Re: How the Zoom macOS installer does its job without you clicking ‘install’
#332Can someone explain to me what the problem is? If you run the installer, isn't that consent to install the software? That's the whole point of it. I guess this isn't the "Mac way" but this is exactly how I would write an install script if I was slapping together support for other platforms. In fact this is the same way most installers work: it unzips an archive somewhere, then creates the links for remove/launch/etc.…
Zoom is using a hook in the macOS installer framework in a way that is not intended. This is forming a troubling pattern [1]. Zoom will do anything to reduce the number of clicks to start a conference, even if results in a misleading installer prompt or security vulnerability. [1]: https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
Many PMs are obsessed with click optimization. I've been told many times that a certain feature of security method is no-go due to it being "too many clicks" full-stop -.-
Re: How the Zoom macOS installer does its job without you clicking ‘install’
#333Earlier quoted context omitted.
Zoom has a web client that "just works" but they only show it as an option after they detect that their native client didn't "just work".
That's weird, when I open a meeting link (which would open the native client) at the bottom of the page it says "If you cannot download or run the application, join from your browser.". I have the native client and it still shows me this option.
The visibility of this link is disabled by default unless the person trying to join attempts (and fails, even if deliberately) to download+install the client at least twice.
It can be enabled, but it's not on by default.
Re: How the Zoom macOS installer does its job without you clicking ‘install’
#334I really wish they'd make the client available in the Mac App Store. Not only is the installation experience better than this, things also stay nicely up-to-date. If your company runs an MDM for your Macs, it's easy to deploy apps en-mass to everyone.
But then they'd need to opt-in to sandboxing and other "onerous" requirements and couldn't pull shady things like this.
Nailed it.