Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

news.ycombinator.com

Post reply on HN
Print view View original

141–150 of 181 posts

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#141

Post by AnIdiotOnTheNet »

jcelerier wrote: post #75
lvillani wrote: post #66

Earlier quoted context omitted.

Another reason could be to ensure that you have at most one copy of the application ever, since you can force it to install stuff always at the same location. On an unrelated product we learned that users ended up with many different copies of the app scattered throughout the system, if they were allowed to use the traditional bundle + DMG distribution method. Spotlight would then helpfully pick one random copy, with…

yes, it's a total pain. users send you a crash log, you see that they're on an old version, ask them to update. They say they do, you get the next crash log, and it's still the old version. And then you get a screenshot and you see 12 different versions of your .app, in the desktop, in ~/Applications, in /Applications...

Maybe, but that's also an advantage. Often it is useful to have two versions of the same application available, for example if you are testing one of them, or if a feature or compatibility was broken somewhere along the way. Typical package manager software installation does not accommodate such use cases.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#142

Post by adwww »

xnyan wrote: post #107
berdario wrote: post #96

Earlier quoted context omitted.

Good question, I think it should be the corporate one, and even if it might be a bit more work to setup, it's definitely in the company's interest, since then the applications that are installed can be sandboxed and be vetted/whitelisted more easily.

App Store is disabled on my enterprise mac, same for my last job. I think it's fairly common.

Same as mine, but I didn't know if it was common or not.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#143

Post by damnyou »

occamrazor wrote: post #62
fiddlerwoaroof wrote: post #17

I still don’t understand the issue with this: it’s not using this feature as intended, but they’re not exploiting any vulnerabilities or attempting to exploit a privilege escalation bug in macOS. Apple’s installers allow these scripts to do anything (and I believe there’s a prompt along the lines of “this installer will run a script to determine if the package can be installed”).

It isn’t a _security_ issue, because the script doesn’t circumvent any security restrictions, but it is a _trust_ issue, because the script abuses pre-install functionality to install the program without explicit user agreement: A Mac user expects a confirmation prompt, but never receives one.

Can you point to data which shows that Mac users expect confirmation prompts? Because my thoughts are that no, Mac users don't have any expectations from installers other than to get out of the way as quickly as possible (which the script approach achieves).

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#144

Post by damnyou »

thu2111 wrote: post #74
qwerty456127 wrote: post #72

I believe this is not hard to detect. Apple should detect this and report such an installer as particularly risky. Chances are the majority of installers working this way actually are malware, legitimate apps like Zoom and WebEx probably are exceptions.

That's extremely unlikely. Malware on macOS isn't prevalent. There is no market for anti-virus vendors on macOS, and Apple have been repeatedly tightening the approval process for macOS software. Gatekeeper only ever gets more aggressive, not less. Meanwhile videocall software is widespread, it's rapidly become a necessity for a large part of the world's population. I wouldn't be surprised if on macOS it's now in sec…

Thank you for being the voice of reason here. The fundamental issues are with Apple and macOS, not vendors trying to make sure everyone who downloads the app can install it.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#145

Post by TazeTSchnitzel »

zymhan wrote: post #138
knome wrote: post #132

Earlier quoted context omitted.

That seems pretty ridiculous coming from Linux, where the vast majority of software will be installed via a package manager, making clean removal trivial. Under windows, I would consider any software that requires a separate removal tool to be suspect. Software wanting you to download a separate tool, fill out unavoidable surveys or linking you to a site to track uninstallations is all very seedy practices. Why isn't…

> Why isn't it expected of Mac software to keep an installation manifest and provide a way for removing the software? It is dead simple to remove a .app from the Applications folder. Sadly the pkg installers also throw files everywhere. Some software does include an uninstaller pkg, like Windows apps will include an uninstall.exe. But like windows, not everyone is meticulous about making sure you can uninstall cleanl…

macOS not having a standardised uninstaller format nor an equivalent to the Windows Add/Remove Programs is a strange deficiency. You are lucky if a pkg-installed program comes with an uninstaller, alas.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#146

Post by damnyou »

ken wrote: post #32
gamegod wrote: post #13

Earlier quoted context omitted.

The Mac App Store is a trap - The sandboxed APIs are severely limited, and no large company is going to let Apple get even more in-between them and their customers.

First, they can use the sandbox without going through the Mac App Store. Sandboxing is a good idea regardless of distribution method. That would improve security for everybody, without needing to 'let Apple get in between them and their customers'. Second, Zoom already runs sandboxed for the other two ways you can run their client on Apple operating systems: the (iOS) App Store and the web. The Mac sandbox is the lea…

The issue is not technical. It is political. Apple is arbitrary and capricious, and no one sensible wants every update to their software to be held hostage to Apple's whims. Large companies like Facebook can cut special deals.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#147

Post by oefrha »

knome wrote: post #132
oefrha wrote: post #69

Earlier quoted context omitted.

Having to download a separate uninstaller or having complicated uninstallation instructions does not in any way, shape, or form indicate there’s anything funny going on with the pkg installer. Any pkg installer (or any app bundle, if you want to completely remove all traces of it) would require a separate uninstaller to install, and any pkg installing to multiple directories will be complicated to uninstall, not even…

That seems pretty ridiculous coming from Linux, where the vast majority of software will be installed via a package manager, making clean removal trivial. Under windows, I would consider any software that requires a separate removal tool to be suspect. Software wanting you to download a separate tool, fill out unavoidable surveys or linking you to a site to track uninstallations is all very seedy practices. Why isn't…

Re installation manifest: I did point out you can lsbom to get the list of installed files from a package (well, unless you use a trick like discussed here; you can do anything in postinstall scripts too on Linux, at least with apt). But programs generate config, state, and data, and those need to removed if you want to “completely uninstall” a program.

Linux certainly does not make clean removal (/etc, /var, dotfiles/directories) easy.

Oh, and the “separate tool” can be pre-bundled, whether you have to download it separately is orthogonal. Pretty much every Windows program has a separate uninstaller, because on Windows you simply can’t uninstall yourself.

https://ss64.com/osx/lsbom.html

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#148

Post by Saaster »

I work in a tech company. The number of people you see who have their desktop filled with permanently mounted DMGs, launching their apps by opening said DMG and launching their trusty old Chrome version 53 by double-clicking the icon would blow your mind.

Users don't use your software as you would like them to. Zoom now requires ~4 clicks to update when a new version is released as you click through the installer steps. You have to click the single frickin' disk icon (which is the only disk 99.9% of Apple users are going to have... still you have click on it) in one of the steps for the Next button to activate. Result: I fully expect a large percentage of the users to never update their Zoom successfully again. Great win for the users, the software which you downloaded, then clicked to install, no longer executes that scary pre-install script.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#149

Post by abduhl »

vermilingua wrote: post #64
ddrt wrote: post #52

Earlier quoted context omitted.

Is it officially considered malware by apple? If so... feds don’t screw about. Those guys could be in serious trouble.

Well then they’re lucky that law enforcement has a slightly more involved process to determine criminality than checking Apple’s malware filter list.

But should they?

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#150

Post by KORraN »

Saaster wrote: post #148

I work in a tech company. The number of people you see who have their desktop filled with permanently mounted DMGs, launching their apps by opening said DMG and launching their trusty old Chrome version 53 by double-clicking the icon would blow your mind. Users don't use your software as you would like them to. Zoom now requires ~4 clicks to update when a new version is released as you click through the installer ste…

Not sure about what clicking disk icon you are talking about, but today's update showed up as regular pkg installer ("Next", "Next", "Accept", "Finish").
Post reply on HN