Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 181 posts

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#31

Post by 14k12j41j211 »

fiddlerwoaroof wrote: post #17

I still don’t understand the issue with this: it’s not using this feature as intended, but they’re not exploiting any vulnerabilities or attempting to exploit a privilege escalation bug in macOS. Apple’s installers allow these scripts to do anything (and I believe there’s a prompt along the lines of “this installer will run a script to determine if the package can be installed”).

This is an issue with the installers. The fact that installers on macOS still work like in the 90s baffles me -- I thought they had done something smart with sandboxes, APIs for system privileges, and a "secure path" where user consent uses system-controlled GUI.

This issue mainly tells me that macOS installers are largely like a Windows .exe and Linux curl | sh (well, that's not true since it still needs to be signed…).

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#32

Post by ken »

gamegod wrote: post #13
sigjuice wrote: post #5

Earlier quoted context omitted.

They need to do the work to get on the Mac App Store

The Mac App Store is a trap - The sandboxed APIs are severely limited, and no large company is going to let Apple get even more in-between them and their customers.

First, they can use the sandbox without going through the Mac App Store. Sandboxing is a good idea regardless of distribution method. That would improve security for everybody, without needing to 'let Apple get in between them and their customers'.

Second, Zoom already runs sandboxed for the other two ways you can run their client on Apple operating systems: the (iOS) App Store and the web. The Mac sandbox is the least strict of the three. So whatever they do, it doesn't seem to be hindered by 'severe limitations'.

I have yet to hear any feature that a legitimate videoconferencing application would need that would be disallowed by the macOS sandbox. Lots of other video chat apps are on the Mac App Store, like Facebook Messenger. Is the issue simply that Zoom is being sketchy and wants to continue to be sketchy, and sandboxing would not allow them to? That's not because the MAS is 'a trap'. That's its main feature.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#33

Post by em-bee »

ryandrake wrote: post #21
monadic2 wrote: post #15

Why do these apps require installers at all? What are they installing—presumably any of their proprietary tech can run in userspace unprivileged. Personally, my best guess is because that’s the flow the product manager expected.

The standard way to install an application on the Mac is to simply drag it into the Applications folder. That’s what is expected by users. For the vast majority of applications this should be enough. Whenever I see a Windows-style “installer” the first thing I think is... what kind of shenanigans are going on?

it's not like the app couldn't do those shenanigans when it's first started...

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#34

Post by fiddlerwoaroof »

14k12j41j211 wrote: post #31
fiddlerwoaroof wrote: post #17

I still don’t understand the issue with this: it’s not using this feature as intended, but they’re not exploiting any vulnerabilities or attempting to exploit a privilege escalation bug in macOS. Apple’s installers allow these scripts to do anything (and I believe there’s a prompt along the lines of “this installer will run a script to determine if the package can be installed”).

This is an issue with the installers. The fact that installers on macOS still work like in the 90s baffles me -- I thought they had done something smart with sandboxes, APIs for system privileges, and a "secure path" where user consent uses system-controlled GUI. This issue mainly tells me that macOS installers are largely like a Windows .exe and Linux curl | sh (well, that's not true since it still needs to be signe…

Installers aren’t really the preferred way to distribute software on a Mac, unless you need special access to the system for some reason. Most Mac software is distributed as an application bundle that’s dragged wherever you want on the file system and then run by double-clicking.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#35

Post by diebeforei485 »

x0x0 wrote: post #2

Everyone who's spent 3 hours talking a parent through downloading and installing a Zoom client understands exactly why they're doing this. Mine are unable to (1) reliably download a zip file; (2) navigate to that file using Finder; (3) run something inside it. By the time we were done -- I use copilot (basically VNC with NAT punching built in) -- and I got control of the laptop to just do it myself, there were 7 down…

Surely it would be easier for your parent / MIL to install from the Mac App Store.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#37

Post by pxtail »

cosmotic wrote: post #19
fiddlerwoaroof wrote: post #17

I still don’t understand the issue with this: it’s not using this feature as intended, but they’re not exploiting any vulnerabilities or attempting to exploit a privilege escalation bug in macOS. Apple’s installers allow these scripts to do anything (and I believe there’s a prompt along the lines of “this installer will run a script to determine if the package can be installed”).

They may not be exploiting vulnerabilities but they are breaking the contact with the expectations users have of how installers work.

>with the expectations users have of how installers work

Tbh I think that most people here on hn are experiencing cognitive bias because of additional knowledge - reality is that most of regular users do not give a damn about what installer does, they just want working app.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#38

Post by diebeforei485 »

No wonder their uninstallation instructions[1] are hilariously complicated. They somewhat-helpfully point to an actual separate uninstaller package to download, but it doesn't even remove all the things mentioned on this page.

1. https://help.webex.com/en-us/WBX38280/How-Do-I-Uninstall-Web...

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#39

Post by figbert »

panic wrote: post #29
monadic2 wrote: post #15

Why do these apps require installers at all? What are they installing—presumably any of their proprietary tech can run in userspace unprivileged. Personally, my best guess is because that’s the flow the product manager expected.

It seems unnecessary for core functionality at least -- I installed Zoom by unpacking the .app from the .pkg by hand (without running any installer scripts) and it works fine.

Mind throwing me the name of or link to the program you used to unpack the .app? I'd like to do that myself, and remember stumbling on a program that did that, but can't recall the name.
Post reply on HN