Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#1

Post by vicken » Fri, Apr 03, 2020, 8:48 PM UTC

I noticed something really peculiar this morning when I was invited to a Zoom meeting. I had uninstalled Zoom the night before but when I clicked the Join Meeting link, I was still prompted by the browser to open the zoom.us application. I went ahead and clicked OK to open it and I got the OSX popup: "You're opening the application "zoom.us" for the first time. Are you sure you want to open this application?" (https://imgur.com/nsOV3d5)

I checked my Applications folder and didn't see Zoom there so I clicked the "Show Application" button in the popup and it ended up opening the Applications folder from one of my Time Machine backups with Zoom installed.

I tested this with both Firefox and Chrome with the same results. Now I don't know if this is an OSX specific issue, a browser issue, or a Zoom issue.

Can anyone else confirm the same or similar behavior on Mac? If anyone can also shed some insight about this behavior, it would be much appreciated.

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#2

Post by taurath » Fri, Apr 03, 2020, 10:20 PM UTC

I guess in some sense it is the price one pays for "it just works". The main problem I have is this seems like going to very far extremes in order to run the app no matter what and the tradeoffs were never discussed or put in front of people, which I find to be pretty unethical. Sort of like the privacy debate - the tradeoffs of everyone sharing their personal data were never really up for debate.

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#3

Post by vicken » Fri, Apr 03, 2020, 10:26 PM UTC

taurath wrote: post #2

I guess in some sense it is the price one pays for "it just works". The main problem I have is this seems like going to very far extremes in order to run the app no matter what and the tradeoffs were never discussed or put in front of people, which I find to be pretty unethical. Sort of like the privacy debate - the tradeoffs of everyone sharing their personal data were never really up for debate.

If this is intentional, I'm just curious how it works. I feel like this could lead to a vulnerability or exploit.

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#4

Post by nexuist » Fri, Apr 03, 2020, 10:28 PM UTC

taurath wrote: post #2

I guess in some sense it is the price one pays for "it just works". The main problem I have is this seems like going to very far extremes in order to run the app no matter what and the tradeoffs were never discussed or put in front of people, which I find to be pretty unethical. Sort of like the privacy debate - the tradeoffs of everyone sharing their personal data were never really up for debate.

This is a bit of a charitable explanation. How can any project manager say, with a straight face, "we need to make sure the application is still available, even if the user deletes it." How can you accidentally delete an application? It is not like you press a button by accident and it is suddenly gone. Deleting an application requires the user to express intent and go through a process (go to the Applications folder, find the app, delete it, remove from trash).

There is malware that is easier to get rid of than Zoom.

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#5

Post by mikekij » Fri, Apr 03, 2020, 10:28 PM UTC

I wasn't aware that any non-OS service even had access to data and applications saved in Time Machine. This might be worthy of a bug bounty report to Apple.

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#6

Post by saagarjha » Fri, Apr 03, 2020, 10:30 PM UTC

This sounds like it might be a bug/misconfiguration in Launch Services, which deals things like application registration and URL scheme handling. Since I would expect your browser to do something like call to the system to open the URL (LSOpenURLsWithRole, et al.) I don't think this is a problem with Zoom.

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#7

Post by wool_gather » Fri, Apr 03, 2020, 10:32 PM UTC

It's doubtful that this is Zoom doing anything in particular.

Rather it's likely the OS doing the best it can to handle the URL for you. The OS has a mapping between the URL and the bundle identifier of the app, and apparently looked for the bundle on a disk that happened to be attached, after it didn't find it on your main disk. Which is perfectly reasonable in itself.

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#8

Post by saagarjha » Fri, Apr 03, 2020, 10:33 PM UTC

mikekij wrote: post #5

I wasn't aware that any non-OS service even had access to data and applications saved in Time Machine. This might be worthy of a bug bounty report to Apple.

  $ ls /Volumes/YourTimeMachineBackup/Backups.backupdb/YourComputerName

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#9

Post by aasasd » Fri, Apr 03, 2020, 10:33 PM UTC

Sort of sidetracking, but: afaik applications open from a browser via a custom protocol in a link, and for that the application has to be already installed—unless MacOS offers to search the app store (if it does, not sure). So, this suggests to me that either MacOS leaves protocol associations in place after uninstalling an app, and has the machinery to resurrect such an app from the backups, or Zoom leaves around a protocol-handling app after an uninstall.

Re: Tell HN: Zoom runs application from Time Machine backup when uninstalled on Mac

#10

Post by ben509 » Fri, Apr 03, 2020, 10:33 PM UTC

It'll do that with any application on the Mac, this is not peculiar to Zoom. The Time Machine backup is, as far as the Finder is concerned, just another volume. It'll prefer applications on the root volume, but it'll launch them from other volumes as well.