Apple has pushed a silent Mac update to remove hidden Zoom web server • Hacker News Board

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#531

Post by harry8 » Fri, Jul 12, 2019, 12:26 AM UTC

harry8 wrote: post #237

rawrmaan wrote: post #35

That's pretty epic. Apple continues to make big, brave moral gestures (like when they yanked Facebook and Google's enterprise certs earlier this year, or killed long-term tracking cookies in Safari overnight). Makes me happy to be a customer. Hope they keep enforcing their own rules and protecting their users' privacy and security in this fearless manner.

Wouldn't it be EPIC if apple produced a statement saying "We are not going to keep any data at all about you unless we are forced to do so legally. We are bound by that contract with you when you purchase our device." Then followed that with "We're going to make it as hard as humanly possible for anyone else to collect and keep data about you if you own one of our devices. Including both legal and technical solutions…

Well that's what Apple might do if they really were in the business of being paid by customers to serve those paying customers and nobody else.

But of course Apple literally wrote the book on selling their customers as product to third parties. They've been wildly successful at it. Microsoft, IBM look on in envy at how they've managed to get away with it.

Since it has been massively profitable for them to turn their customers into their product, they see no reason to change and I guess why should they? Profit maximisation is their business, yours and my health and welfare is only of interest in service to maximising profit. If they did anything else they might be guilty of securities fraud(!) So yeah, they can be completely horrific and still win the PR battle because others seem even worse.

I see these statements of fact are always jarring for people to notice for the first time, especially if they quite like the machines (I do), and quite like liberal democracy and free market economics (again I do!) and more so that this utter hideousness is our best option right now because there is no option even remotely on the same planet as good. It is thoroughly depressing all round.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#532

Post by Digital-Citizen » Fri, Jul 12, 2019, 12:40 AM UTC

matkoniecz wrote: post #427

Digital-Citizen wrote: post #321

Earlier quoted context omitted.

According to the article, "Apple said the update does not require any user interaction and is deployed automatically.". There's nothing moral about using "silent updates" (updates the user has no opportunity to decide whether to adopt). Apple certainly wasn't looking out for their users' privacy and security when they let an iTunes bug go unfixed for 3 years (see http://www.telegraph.co.uk/technology/apple/8912714/Ap…

> There's nothing moral about using "silent updates" Sorry, but this is absurd. Automatic security updates are necessity. And no user read through all changelogs of all updated software (except extremely critical systems). Maybe you wanted to argue for ability to downgrade and disable updates?

There's no call to write in such patronizing ways.

It should be up to the user to decide whether to take on updates, regardless of what you think because that's their computer and not yours and you each deserve control over the computers you own. Just as freedom of speech means sometimes people will say things you disagree with, free software computers means not everyone will keep up with the updates. But not offering software freedom is unethical and neither Zoom nor Apple are distributing software freedom. Apple has a clear record of using the power of a proprietor to expose their users to harm (more examples at https://www.gnu.org/proprietary/malware-apple.html ) and this story is an example of how Zoom apparently does as well.

What you and other posters are tellingly refusing to address is the immorality of software nonfreedom. As I wrote before, this is the core of the issue.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#533

Post by philwelch » Fri, Jul 12, 2019, 1:33 AM UTC

wwright wrote: post #81

curt15 wrote: post #76

Earlier quoted context omitted.

Indeed a company's "morals" are better exposed when it has to make inconvenient choices.

I would say true morals lead to structuring your company in such a way that you don’t have to rely on business people making ethical decisions moment to moment, because they won’t.

How is that even possible?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#534

Post by oil25 » Fri, Jul 12, 2019, 2:04 AM UTC

saagarjha wrote: post #352

oil25 wrote: post #233

Earlier quoted context omitted.

> Let me introduce you to the nice folks over at Objective See.. https://objective-see.com/products.html The "nice folks" at Objective-See is Patrick Wardle, a former NSA rootkit expert who would like nothing more than to install various close-sourced components on your computer.

I'm not necessarily a fan of Patrick Wardle, but his software is open source: https://github.com/objective-see/

Some software components are open source, others are not.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#535

Post by rileymat2 » Fri, Jul 12, 2019, 6:26 AM UTC

microtonal wrote: post #322

rileymat2 wrote: post #244

Earlier quoted context omitted.

Not really, If you have a standard app that can be dragged into the trash, sure. If you have a kernel extension, or a launch deamon or any application data you store locally you cannot clean up after yourself without a custom uninstaller. Windows is far ahead in its centralized Add&Remove Programs area.

Not really, If you have a standard app that can be dragged into the trash, sure. If you have a kernel extension, or a launch deamon or any application data you store locally you cannot clean up after yourself without a custom uninstaller. This is false. Kernel extensions can be part of the application bundle and will be unloaded and removed when the bundle is removed. Installing KEXTs in an application bundle allows…

I am not sure it is false if you want it loaded on startup.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#536

Post by oil25 » Fri, Jul 12, 2019, 7:01 AM UTC

dymk wrote: post #324

oil25 wrote: post #206

Earlier quoted context omitted.

> iMessage is end-to-end encrypted. The keys are managed by the devices themselves. There is no facility to backdoor or intercept the messages. That is only a half-truth. Apple controls the key infrastructure; they may replace your keys with arbitrary ones at the demand, coercion or compromise by any number of bad actors. The software is closed source, making it impossible to verify any actual claims made otherwise.…

I find it disappointing that we blame companies operating in China and not the real forcing function for all this: the Chinese government

Regarding them as distinct actors is a mistake. Both enable each other: Apple enables pervasive surveillance; in turn China enables huge profits. How bottomless is the guile of a corporation willing to put lives at risk to make some money?

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#537

Post by mrmanner » Fri, Jul 12, 2019, 7:59 AM UTC

Digital-Citizen wrote: post #532

matkoniecz wrote: post #427

Earlier quoted context omitted.

> There's nothing moral about using "silent updates" Sorry, but this is absurd. Automatic security updates are necessity. And no user read through all changelogs of all updated software (except extremely critical systems). Maybe you wanted to argue for ability to downgrade and disable updates?

There's no call to write in such patronizing ways. It should be up to the user to decide whether to take on updates, regardless of what you think because that's their computer and not yours and you each deserve control over the computers you own. Just as freedom of speech means sometimes people will say things you disagree with, free software computers means not everyone will keep up with the updates. But not offerin…

> It should be up to the user to decide whether to take on updates, regardless of what you think because that's their computer and not yours and you each deserve control over the computers you own.

Which is why the user can CHOOSE to have automatic updates. Or not to. The default when buying a new Mac is that automatic updates are enabled, because that’s the product Apple wants to sell and that they believe most of their users want to buy. It’s secure, it’s practical, it’s fun.

If you want to be your own IT department you simply deactivate all or some automatic updates. If you want a secure computer and trust Apple you leave it on.

I don’t see how this is a big moral question at all. Let people organize their computing needs in a way that’s safe and practical for them, not in the way that’s safe and practical for you.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#538

Post by Crinus » Fri, Jul 12, 2019, 11:48 AM UTC

HeWhoLurksLate wrote: post #454

Crinus wrote: post #392

Earlier quoted context omitted.

> Someone brings this argument up _every single time_ a tech company takes action against something malicious. The argument isn't about taking action against something malicious, the argument is about the implications of being able to take that action and what sort of power the company has and if they should have it in light of past abuses (not necessarily but that company, but this is totally irrelevant since compan…

> > This will never happen > You cannot guarantee that. Can you guarantee that it will happen within the next, say, 5, 10, 15, or 20 years? Somewhere within there, the devices we're currently using will likely be replaced, and the landscape will have changed. What I personally care about, privacy-wise, is the present and near future- will my family be safe on the internet with what I've set up for the next five years…

And this sort of widespread short-sighted behavior is why over time we lose nice things that at the past we took for granted.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#539

Post by Crinus » Fri, Jul 12, 2019, 11:50 AM UTC

HeWhoLurksLate wrote: post #449

Crinus wrote: post #399

Earlier quoted context omitted.

These are unimportant details, the issue is with Apple modifying people's computers silently and the users themselves having no knowledge or any say about it. Replace this instance with something that you disagree about (imagine Apple removing VPN software from Chinese customers due to demands from China or "fixing" existing VPN software with backdoors that enable Chinese authorities to wiretap Chinese people) and se…

> something something Apple, a US-based company who prides itself on privacy helping China spy on people. Apple engineers go to China . Anything they do to help the Chinese government can immediately affect their own workers. If they did that, and a bunch of people with Apple devices got thrown in jail / whatever, their stock, and moral standing, would suffer some serious blow-back for it. Google Chrome has a thing t…

I already wrote

> (if that example would happen or not is irrelevant, i'm making it to help you see the issue in a context i think you'd disagree with Apple about, i'm not making it for you to argue if that would happen or not)

It is in its own paragraph. That China part wasn't meant to be debated, it was meant as an example of an event that if it happened would make you disagree with Apple. The important part of this example is you disagreeing with Apple, not the reason why.

Re: Apple has pushed a silent Mac update to remove hidden Zoom web server

#540

Post by Crinus » Fri, Jul 12, 2019, 11:53 AM UTC

dpkonofa wrote: post #507

Crinus wrote: post #399

Earlier quoted context omitted.

These are unimportant details, the issue is with Apple modifying people's computers silently and the users themselves having no knowledge or any say about it. Replace this instance with something that you disagree about (imagine Apple removing VPN software from Chinese customers due to demands from China or "fixing" existing VPN software with backdoors that enable Chinese authorities to wiretap Chinese people) and se…

>the users themselves having no knowledge or any say about it. This is not true. You can disable all the automatic updates in System Preferences.

This is a nuclear option and the issue isn't getting updates, the issue is being silent and not offering any control over that. See my other replies about Windows Defender about what i meant with that.