Live data from Hacker News

Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

news.ycombinator.com

51–60 of 181 posts

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#51

Earlier quoted context omitted.

It would have to ask for Admin role to do so, though.

The installer has to ask too though, doesn't it? So using an installer still provides no benefit.

Yes, but the point is that most Mac apps should need neither installer nor admin privileges.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#52
post #23
post #18

The founder of Zoom used to work at WebEx before it was acquired. Wouldn't be surprised if he brought along some WebEx folks as well.

I would love to see a lawsuit about stolen malware IP.

Is it officially considered malware by apple? If so... feds don’t screw about. Those guys could be in serious trouble.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#53

Why do these apps require installers at all? What are they installing—presumably any of their proprietary tech can run in userspace unprivileged. Personally, my best guess is because that’s the flow the product manager expected.

Do these apps request accessibility permissions for screen sharing and the like during install?

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#54
post #16

Earlier quoted context omitted.

So you want Zoom and Webex to submit a patch to OSX?

I would say they should put pressure on Apple to make the install flow better, but what am I saying; this is Apple.

Haha :) Tiny companies should put pressure on $1T Apple to change the install flow...

I wonder how could Apple take 30% their revenue out of this -- yeah, by forcing them to submit the apps to the AppStore instead!

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#55
post #20

Earlier quoted context omitted.

> “this installer will run a script _to determine if the package can be installed_” Why would the user expect that script to install the application, or even modify their system in any way?

The fact that Apple allows an application to be installed in this step is an issue with Apple's design.

Maybe so, but that doesn't excuse those exploiting that flaw.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#56

Why do these apps require installers at all? What are they installing—presumably any of their proprietary tech can run in userspace unprivileged. Personally, my best guess is because that’s the flow the product manager expected.

The standard way to install an application on the Mac is to simply drag it into the Applications folder. That’s what is expected by users. For the vast majority of applications this should be enough. Whenever I see a Windows-style “installer” the first thing I think is... what kind of shenanigans are going on?

This standard way doesn't work in corp environments (which WebEx and Zoom are targeting primarily), where machines are remotely provisioned. For decent macOS remote installs and updates you need the PKG format scripts.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#57
post #39
post #29

Earlier quoted context omitted.

It seems unnecessary for core functionality at least -- I installed Zoom by unpacking the .app from the .pkg by hand (without running any installer scripts) and it works fine.

Mind throwing me the name of or link to the program you used to unpack the .app? I'd like to do that myself, and remember stumbling on a program that did that, but can't recall the name.

Pacifist used to be the go-to app for this; probably still is.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#58

Earlier quoted context omitted.

This is an issue with the installers. The fact that installers on macOS still work like in the 90s baffles me -- I thought they had done something smart with sandboxes, APIs for system privileges, and a "secure path" where user consent uses system-controlled GUI. This issue mainly tells me that macOS installers are largely like a Windows .exe and Linux curl | sh (well, that's not true since it still needs to be signe…

Installers aren’t really the preferred way to distribute software on a Mac, unless you need special access to the system for some reason. Most Mac software is distributed as an application bundle that’s dragged wherever you want on the file system and then run by double-clicking.

I would go as far to say that a good chunk of more technically inclined Mac users have a tendency to view any user facing software that requires an installer with suspicion.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#59

Earlier quoted context omitted.

The fact that Apple allows an application to be installed in this step is an issue with Apple's design.

It’s a script, though; should they sandbox the preinstall phase? That would break most packages.

Instead of silently breaking they could have a popup like "Do you allow the preinstall script to write into /this/folder?" on a write operation outside of the sandbox.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#60
post #52
post #23

Earlier quoted context omitted.

I would love to see a lawsuit about stolen malware IP.

Is it officially considered malware by apple? If so... feds don’t screw about. Those guys could be in serious trouble.

It was when they pushed the update to remove the zoom webserver.
Post reply on HN