The zoom guys are ex-WebEx guys. I saw the same zoom-bombing problem in WebEx few years back. we just enforce adding passcode/PIN to each meeting to remediate customer escalation.
Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
131–140 of 181 posts
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#132No wonder their uninstallation instructions[1] are hilariously complicated. They somewhat-helpfully point to an actual separate uninstaller package to download, but it doesn't even remove all the things mentioned on this page. 1. https://help.webex.com/en-us/WBX38280/How-Do-I-Uninstall-Web...
Having to download a separate uninstaller or having complicated uninstallation instructions does not in any way, shape, or form indicate there’s anything funny going on with the pkg installer. Any pkg installer (or any app bundle, if you want to completely remove all traces of it) would require a separate uninstaller to install, and any pkg installing to multiple directories will be complicated to uninstall, not even…
That seems pretty ridiculous coming from Linux, where the vast majority of software will be installed via a package manager, making clean removal trivial.
Under windows, I would consider any software that requires a separate removal tool to be suspect. Software wanting you to download a separate tool, fill out unavoidable surveys or linking you to a site to track uninstallations is all very seedy practices.
Why isn't it expected of Mac software to keep an installation manifest and provide a way for removing the software?
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#133Earlier quoted context omitted.
7-Zip can do it on windows, maybe there's an osx port?
7-Zip, now there's a fantastic piece of software. It opens damn near everything, has an ultra-lightweight interface and doesn't have any near-malicious money grubbing schemes.
It's not safe to process untrusted files with 7zip
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#134I was surprised that when I ran a WebEx exe on windows to join a meeting, after the meeting concluded a window appeared with my calendar information pulled from outlook. It really highlights how on desktop apps can do what they like. Whilst on mobile platforms at least you have to grant specific access.
I'll admit as a web dev I sometimes take some of the "omg JavaScript" a little personally. Some of the usual pile on articles (granted their complaints aren't technically 'wrong') sometimes imply the browser is a bad place for a lot of things that are happening there privacy wise and etc. I always wonder ... "Uh, do you want platform specific desktop apps? You're not much better protected there man... and app availab…
Well the zoom vulnerability from last year was a failure to consider full consequences of javascript.
They thought binding a web server to localhost and having a browser make requests to it was OK. They did not consider that literally any other web page can make the same requests.
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#135Earlier quoted context omitted.
yes, it's a total pain. users send you a crash log, you see that they're on an old version, ask them to update. They say they do, you get the next crash log, and it's still the old version. And then you get a screenshot and you see 12 different versions of your .app, in the desktop, in ~/Applications, in /Applications...
Even worse when they don't copy it off the DMG. Just leave the DMG mounted.. forever.
What's the problem with leaving the exe in the DMG instead of copying it out? As a user and a developer I don't see any problem with this whatsoever unless the application is poorly built.
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#136Earlier quoted context omitted.
Instead of silently breaking they could have a popup like "Do you allow the preinstall script to write into /this/folder?" on a write operation outside of the sandbox.
99% of users will have no fucking idea what that means. They will either click 'Allow' (which makes this feature useless for 99% of people) or contact tech support (adds friction to installation, which is bad especially for conferencing software) or just give up and not use the product (which is bad for the company).
To be fair, it would at least ruin Zoom's incentive to do any of this, since they wanted a streamlined process that prompts the user less.
Why they didn't just use a dmg that has you drag the application into /Applications/ is something I still don't understand though. Surely that is the simplest most user friendly way to have non-technical users install applications without using the appstore.
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#137Earlier quoted context omitted.
“This installer will run a script to determine if the package can be installed .” Not “This installer will run a script that installs this package without asking further questions, then terminate abruptly without going through the rest of the install process and giving you a chance to decide exactly where it should go”.
I always read the subtext as "This installer will run a script whose stated goal is to determine if the package can be installed, but y'know, it's a script, and its existence is warranted for doing supposedly helpful yet nonstandard checks that the pkg API-or-something doesn't provide, thus can't be sandboxed, and therefore can do anything else it wants to. Would you like to assume trust and proceed anyway, or would…
Zoom and WebEx are certainly taking that subtext but I am pretty sure that is not the intended subtext of that statement. :)
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#138Earlier quoted context omitted.
Having to download a separate uninstaller or having complicated uninstallation instructions does not in any way, shape, or form indicate there’s anything funny going on with the pkg installer. Any pkg installer (or any app bundle, if you want to completely remove all traces of it) would require a separate uninstaller to install, and any pkg installing to multiple directories will be complicated to uninstall, not even…
That seems pretty ridiculous coming from Linux, where the vast majority of software will be installed via a package manager, making clean removal trivial. Under windows, I would consider any software that requires a separate removal tool to be suspect. Software wanting you to download a separate tool, fill out unavoidable surveys or linking you to a site to track uninstallations is all very seedy practices. Why isn't…
> Why isn't it expected of Mac software to keep an installation manifest and provide a way for removing the software?
It is dead simple to remove a .app from the Applications folder. Sadly the pkg installers also throw files everywhere. Some software does include an uninstaller pkg, like Windows apps will include an uninstall.exe. But like windows, not everyone is meticulous about making sure you can uninstall cleanly.
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#139Earlier quoted context omitted.
Having to download a separate uninstaller or having complicated uninstallation instructions does not in any way, shape, or form indicate there’s anything funny going on with the pkg installer. Any pkg installer (or any app bundle, if you want to completely remove all traces of it) would require a separate uninstaller to install, and any pkg installing to multiple directories will be complicated to uninstall, not even…
That seems pretty ridiculous coming from Linux, where the vast majority of software will be installed via a package manager, making clean removal trivial. Under windows, I would consider any software that requires a separate removal tool to be suspect. Software wanting you to download a separate tool, fill out unavoidable surveys or linking you to a site to track uninstallations is all very seedy practices. Why isn't…
> That seems pretty ridiculous coming from Linux, where the vast majority of software will be installed via a package manager, making clean removal trivial.
Except that packaging (in the package manager sense) and distributing proprietary software for Linux, with its too-many distros and even-more-too-many library versions, is such a pain in the ass that almost no one does it in the first place.
Now AppImage, that's trivial.
Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom
#140No wonder their uninstallation instructions[1] are hilariously complicated. They somewhat-helpfully point to an actual separate uninstaller package to download, but it doesn't even remove all the things mentioned on this page. 1. https://help.webex.com/en-us/WBX38280/How-Do-I-Uninstall-Web...
What's real great is they didn't notorize the app. So on Mac you have to individually allow about 30 java bits in a row.
Yes - holy crap is it annoying. I found the best way was to only launch meetings from their desktop client :S