Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How the Zoom macOS installer does its job without you clicking ‘install’

twitter.com

Post reply on HN
Print view View original

31–40 of 334 posts

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#31

Post by ilikehurdles »

t0mas88 wrote: post #10
aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?

Don’t Google and Microsoft answers both require accounts, and carry with them the expectation that everything you do on their platforms is recorded for the purpose of selling ads?

Also I regularly attend more than 50-person zoom calls without a hiccup. Google I think requires an enterprise plan to get to that limit, and I don’t even know what the name of their video conferencing product is at this point.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#32

Post by lukevp »

aequitas wrote: post #26
t0mas88 wrote: post #10

Earlier quoted context omitted.

I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?

We just had a corporate presentation with around 250 people. Normally we use Teams or Slack for internal communication, this was also stated by management, that Zoom should only be used for 'big' meetings like this. I think they know the other solutions will not work as well for bigger groups. I've not had issues with using either solution for small group meetings. Actually I have to go out of my way to run Zoom in t…

Why not use Teams Live for this? We have been using zoom and Teams alternately and Teams performance and ease of use has been much better in my experience, but we have yet to do a 200+ all hands so I was curious if there were some footguns with teams live that you may know about. Teams live works on a lot of platforms and also has a web version.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#33

Post by lukevp »

gnud wrote: post #16
zuppy wrote: post #13

Earlier quoted context omitted.

they work for your use case. hangouts can’t handle many users (is it 10 the limit?), which is a deal breaker for me. we’ve tried and people couldn’t join the call. if by microsoft you mean teams, i’m not aware of it working without accounts (not an issue for google as most people have google accounts).

Teams works for "guest users", but they have to be let into the meeting by a "real" user. Also, I think it's possible for companies to disallow guest users on their team instance.

Teams live can work without logins but you have to make the feed public with a hidden link.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#35

Post by rainforest »

xenophonf wrote: post #28

I missed the part where Zoom is holding people's computers for ransom, or formatting the drive, or exfiltrating sensitive information to criminals or state intelligence officers, or mining bitcoin, or other similarly malicious behaviors. An admin can write to /Applications without privilege escalation? That's a macOS bug. If the operating system didn't rely on an 80s-style put-all-the-executables-in-one-place app lau…

> So yeah, Zoom is (ab)using flaws in macOS to get itself installed with minimum fuss, but it isn't doing it with evil intent.

But... why? What other software vendors look at the OS security model from a viewpoint of 'how do we bypass this as much as possible?' If it's not evil intent, what is it, incompetence?

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#36

Post by mywittyname »

krageon wrote: post #25
Fiahil wrote: post #7

Earlier quoted context omitted.

Enterprise customer DO give a damn about security. They can be slow to react, but rules are also there for a very long time. If Zoom doesn't want to loose most of their marketshare in favor of WebEx, they should probably address these issues.

> Enterprise customer DO give a damn about security You are wrong. Even without extensive experience in the space, you can very easily see how even large companies don't secure themselves at all. The US has had equifax recently, and it's not like that was an isolated example either. There just isn't a security culture at the eye-watering heights of corporate upper management and while everyone's as busy making money…

This has been my experience as well. Large companies pay lip-service to security that protects their customers; they want just enough for legal deniability in the event of a breach, but not so much that it impacts operations or profits.

However, they can be...enthusiastic when it comes to security around protecting themselves. If you report an issue with customer information on a public S3 bucket, they might get around to fixing it someday, but if there are "trade secrets" or the like in that bucket, the issue is going to get fixed immediately and someone with a big title probably won't be coming in tomorrow.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#37

Post by rainforest »

t0mas88 wrote: post #10
aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?

Zoom has a web client that "just works" but they only show it as an option after they detect that their native client didn't "just work".

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#38

Post by javagram »

rainforest wrote: post #35
xenophonf wrote: post #28

I missed the part where Zoom is holding people's computers for ransom, or formatting the drive, or exfiltrating sensitive information to criminals or state intelligence officers, or mining bitcoin, or other similarly malicious behaviors. An admin can write to /Applications without privilege escalation? That's a macOS bug. If the operating system didn't rely on an 80s-style put-all-the-executables-in-one-place app lau…

> So yeah, Zoom is (ab)using flaws in macOS to get itself installed with minimum fuss, but it isn't doing it with evil intent. But... why? What other software vendors look at the OS security model from a viewpoint of 'how do we bypass this as much as possible?' If it's not evil intent, what is it, incompetence?

It’s about making your software as easy to use as possible.

Users don’t like UAC or having to click through a dozen dialogs. They just want to get into their virtual meeting.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#39

Post by rainforest »

tantalor wrote: post #21
Wowfunhappy wrote: post #14

Earlier quoted context omitted.

Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.

It doesn't look legit, it looks like the installer script is faking a system dialog in this screenshot: https://twitter.com/c1truz_/status/1244737675191619584/photo... This message is a lie; it not coming from system but from the installer script. Just because the OS is used to show the dialog doesn't mean it should be trusted. As other commenter noted this could be used to steal passwords; that is effectively what i…

To their credit, they seem to be using AuthorizationExecuteWithPrivileges which doesn't get the user's password, but executes a command as root, which is marginally better than stealing the password like Dropbox did.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#40

Post by tantalor »

rainforest wrote: post #39
tantalor wrote: post #21

Earlier quoted context omitted.

It doesn't look legit, it looks like the installer script is faking a system dialog in this screenshot: https://twitter.com/c1truz_/status/1244737675191619584/photo... This message is a lie; it not coming from system but from the installer script. Just because the OS is used to show the dialog doesn't mean it should be trusted. As other commenter noted this could be used to steal passwords; that is effectively what i…

To their credit, they seem to be using AuthorizationExecuteWithPrivileges which doesn't get the user's password, but executes a command as root, which is marginally better than stealing the password like Dropbox did.

How hard do you think it is to steal a password once you have root?
Post reply on HN