Live data from Hacker News

Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

news.ycombinator.com

151–160 of 181 posts

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#151

I work in a tech company. The number of people you see who have their desktop filled with permanently mounted DMGs, launching their apps by opening said DMG and launching their trusty old Chrome version 53 by double-clicking the icon would blow your mind. Users don't use your software as you would like them to. Zoom now requires ~4 clicks to update when a new version is released as you click through the installer ste…

I don't understand. How is difficulty completing the initial installer relevant to autoinstalling updates?

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#152

No wonder their uninstallation instructions[1] are hilariously complicated. They somewhat-helpfully point to an actual separate uninstaller package to download, but it doesn't even remove all the things mentioned on this page. 1. https://help.webex.com/en-us/WBX38280/How-Do-I-Uninstall-Web...

What's real great is they didn't notorize the app. So on Mac you have to individually allow about 30 java bits in a row.

Beautiful mondegreen for notarize.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#153
post #123
post #80

I was surprised that when I ran a WebEx exe on windows to join a meeting, after the meeting concluded a window appeared with my calendar information pulled from outlook. It really highlights how on desktop apps can do what they like. Whilst on mobile platforms at least you have to grant specific access.

I'll admit as a web dev I sometimes take some of the "omg JavaScript" a little personally. Some of the usual pile on articles (granted their complaints aren't technically 'wrong') sometimes imply the browser is a bad place for a lot of things that are happening there privacy wise and etc. I always wonder ... "Uh, do you want platform specific desktop apps? You're not much better protected there man... and app availab…

There's no fundamental technical reason why apps can't run as their own users (like apache and postgres have done for 20 years) and and use something like oauth to control sharing data with other apps. Just laziness.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#154

Earlier quoted context omitted.

yes, it's a total pain. users send you a crash log, you see that they're on an old version, ask them to update. They say they do, you get the next crash log, and it's still the old version. And then you get a screenshot and you see 12 different versions of your .app, in the desktop, in ~/Applications, in /Applications...

Even worse when they don't copy it off the DMG. Just leave the DMG mounted.. forever.

That's good. It's called a portable app and it reduces pollution of your environment. It's a simple partial implementation of something like Docker.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#155

Earlier quoted context omitted.

The fact that Apple allows an application to be installed in this step is an issue with Apple's design.

To be fair, Apple has rectified this flaw by writing the Mac App Store, where applications can't pull these shenanigans and are properly sandboxed from one another.

Why is the store relevant to sandboxing?

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#156
post #73

Earlier quoted context omitted.

“This installer will run a script to determine if the package can be installed .” Not “This installer will run a script that installs this package without asking further questions, then terminate abruptly without going through the rest of the install process and giving you a chance to decide exactly where it should go”.

I always read the subtext as "This installer will run a script whose stated goal is to determine if the package can be installed, but y'know, it's a script, and its existence is warranted for doing supposedly helpful yet nonstandard checks that the pkg API-or-something doesn't provide, thus can't be sandboxed, and therefore can do anything else it wants to. Would you like to assume trust and proceed anyway, or would…

MacOS stupidly runs that script as a user with write permissions.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#157

I still don’t understand the issue with this: it’s not using this feature as intended, but they’re not exploiting any vulnerabilities or attempting to exploit a privilege escalation bug in macOS. Apple’s installers allow these scripts to do anything (and I believe there’s a prompt along the lines of “this installer will run a script to determine if the package can be installed”).

The thing is that Zoom isn't installing the package either! If you look at the list of installed pkgs after installing Zoom there is no Zoom package. They are using a .pkg only for the side effect of running a pre installation script that simply copies Zoom.app in the /Application directory. That is to a software develper garbage, why doing so, when all other macOS application require the user a single drag and drop?…

Why are they doing that? How is it easier than just having the app self install?

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#158
post #150

I work in a tech company. The number of people you see who have their desktop filled with permanently mounted DMGs, launching their apps by opening said DMG and launching their trusty old Chrome version 53 by double-clicking the icon would blow your mind. Users don't use your software as you would like them to. Zoom now requires ~4 clicks to update when a new version is released as you click through the installer ste…

Not sure about what clicking disk icon you are talking about, but today's update showed up as regular pkg installer ("Next", "Next", "Accept", "Finish").

Chrome uses an DMG, and the result is that people are using ancient versions of it straight out of their Downloads or Desktop folders.

Zoom uses an .pkg, and have now removed the one-click install script. So every update to Zoom now runs through the same multi-step Next process as well (with one of the steps inactive until you select your disk, as is customary). If you think that isn't a problem for users, you've never walked grandma through the steps while she's trying to show her screen though the phone to you.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#159

I work in a tech company. The number of people you see who have their desktop filled with permanently mounted DMGs, launching their apps by opening said DMG and launching their trusty old Chrome version 53 by double-clicking the icon would blow your mind. Users don't use your software as you would like them to. Zoom now requires ~4 clicks to update when a new version is released as you click through the installer ste…

I don't understand. How is difficulty completing the initial installer relevant to autoinstalling updates?

Zoom's updates also runs though the entire installer again as of today.

Re: Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

#160
post #123

Earlier quoted context omitted.

I'll admit as a web dev I sometimes take some of the "omg JavaScript" a little personally. Some of the usual pile on articles (granted their complaints aren't technically 'wrong') sometimes imply the browser is a bad place for a lot of things that are happening there privacy wise and etc. I always wonder ... "Uh, do you want platform specific desktop apps? You're not much better protected there man... and app availab…

There's no fundamental technical reason why apps can't run as their own users (like apache and postgres have done for 20 years) and and use something like oauth to control sharing data with other apps. Just laziness.

I'm kinda lost on the comparison between postgres and... web applications?
Post reply on HN