How the Zoom macOS installer does its job without you clicking ‘install’ • Hacker News Board

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#81

Post by m-p-3 » Tue, Mar 31, 2020, 2:38 PM UTC

capableweb wrote: post #4

t0mas88 wrote: post #2

The whole torrent of grey area, just over the line and outright shady behavior at Zoom is a problem in itself even if all the separate instances in isolation aren't grounds to stop using them. Their responses to security issues and today's revelation of misleading marketing on E2E encryption make it clear they're not just making isolated mistakes. Shady is at the core of how they operate, this is an indication that Z…

Unfortunately, the current system and people in power seems to not give a damn about security and shady behavior, as long as the thing they are using is working and working well. Zoom is an example of very useful and performant software with shady company behind it, that's why people will continue using it. Same with Uber, Google and bunch of other companies. It doesn't matter what they do, as their product is helpin…

They're using malware-like behaviors to spread out and reach more customers, even at the cost of security.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#82

Post by m-p-3 » Tue, Mar 31, 2020, 2:41 PM UTC

Fiahil wrote: post #7

capableweb wrote: post #4

Earlier quoted context omitted.

Unfortunately, the current system and people in power seems to not give a damn about security and shady behavior, as long as the thing they are using is working and working well. Zoom is an example of very useful and performant software with shady company behind it, that's why people will continue using it. Same with Uber, Google and bunch of other companies. It doesn't matter what they do, as their product is helpin…

Enterprise customer DO give a damn about security. They can be slow to react, but rules are also there for a very long time. If Zoom doesn't want to loose most of their marketshare in favor of WebEx, they should probably address these issues.

Correct, and we blocked zoom.us on the corporate network. No way we're allowing this malware within our walls.

We already have meet.google.com that works well for us, and external clients can easily join through a web browser.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#83

Post by ForHackernews » Tue, Mar 31, 2020, 2:44 PM UTC

mikorym wrote: post #74

capableweb wrote: post #4

Earlier quoted context omitted.

Unfortunately, the current system and people in power seems to not give a damn about security and shady behavior, as long as the thing they are using is working and working well. Zoom is an example of very useful and performant software with shady company behind it, that's why people will continue using it. Same with Uber, Google and bunch of other companies. It doesn't matter what they do, as their product is helpin…

I think you underappreciate one point here: We can still have long term alternatives to Zoom (and we can have them now). Google and Uber are already difficult to replace or to otherwise challange.

Uber is trivially easy to replace with Lyft or $generic-taxi-app.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#84

Post by samcat116 » Tue, Mar 31, 2020, 2:44 PM UTC

microtonal wrote: post #27

Wowfunhappy wrote: post #14

Earlier quoted context omitted.

Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.

I never understood why Apple still supports the pkg format. It seems a half-baked leftover from the 2000s and even then I was already surprised that there is no way to uninstall things through the macOS GUI. I am not sure if this has changed (I try to avoid pkg files and use Homebrew cask to uninstall such packages), but IIRC you had to list the files with pkgutil on the command-line, remove stuff by hand and then --…

One thing to note here: people who administer macOS for organizations basically convert everything to .pkgs (or DMGs). Its the only easy way to silently install application, and perform post install actions like performing licensing or activation steps.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#85

Post by manigandham » Tue, Mar 31, 2020, 2:48 PM UTC

1) If Zoom can do this then it's a MacOS security bug.

2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI.

3) Malware is defined by what it does, not how it's installed.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#86

Post by j1elo » Tue, Mar 31, 2020, 2:49 PM UTC

Some background info for those commenters who say that Zoom should be requiring just a web browser because web browsers already have everything needed (aka. WebRTC). TL;DR summary: they want to do their own thing, outside of what the WebRTC standard allows, that's all (and enough reason for not using WebRTC?)

Zoom doesn't want to use the stock H.264 encoder as provided by the browser for WebRTC communication. Instead, they use their own video encoders and decoders (which while still being H.264, it is presumedly better optimized for their use case). WebRTC forces you to use either the H.264 or the VP8 encoder/decoder that the browser provides.

How they do this is by having their own custom application that you have to install. Still, some users have noticed that there is a well hidden web-based version of Zoom, which works by again running their custom encoders, thanks to WebAssembly. Also it seems that their video is transmitted via DataCahnnels [0].

They are not alone. Companies want to provide additional "value" by innovating outside of what the WebRTC standard offers. That's nice and all, although it of course tends to disgregation and incompatibilities in the long run. For this reason, I've heard talks about how future revisions of the standard might explore adding WebAssembly support, in order to allow everyone embedding their own compiled components into their applications [1].

[0]: https://webrtchacks.com/zoom-avoids-using-webrtc/

[1]: https://webrtcbydralex.com/index.php/2019/11/13/webrtc-stand...

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#87

Post by pehtis » Tue, Mar 31, 2020, 2:50 PM UTC

pottertheotter wrote: post #17

I installed Zoom on macOS yesterday and I thought that the install was crashing because this is not the expected behavior. I would double click the download, try to install, and then the installation program would "crash", so I'd try it again. Did that a few times before I realized it was installed. Until now I thought it had somehow gotten far enough in the installation process before crashing that I could at least…

I would highly recommend checking all installers on macOS through Suspicious Package. It will give you a complete picture of all the installer scripts that will be run and all the files that will be written. I did just that for zoom and decided against installing it.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#88

Post by manigandham » Tue, Mar 31, 2020, 2:51 PM UTC

swiley wrote: post #50

aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

This still isn’t a good reason to build a native app instead of just using webrtc. Someone should make a PSA site that says something along the lines of “don’t install teleconferencing software because it usually bundles malware; your browser already has the technology built in.”

What do you mean by "bundles malware"? What else is it doing besides teleconferencing?

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#89

Post by jeroenhd » Tue, Mar 31, 2020, 2:52 PM UTC

As someone who's never used or seen Zoom in action, what's pulling people into Zoom that's not already available in other tools (Hangouts Meet, MS Teams) and even works without installing anything (such as Jitsi)?

Based on what I've seen, there's just so much hostile behaviour by the company (including lying about meeting HIPAA e2e requirements!) and the fact that their _official client_ had parts removed by the macOS malware removal tool that I just don't get why people still consider it as an option. If it were the only "just works" tool out there I'd understand, but there's plenty of competition in this space.

I've personally began using the Jitsi server the local student network association has set up and it's been working like a dream. You can even share a window to others (which I didn't even know browsers had support for) for presentations and such.

Re: How the Zoom macOS installer does its job without you clicking ‘install’

#90

Post by gcb0 » Tue, Mar 31, 2020, 2:53 PM UTC

aequitas wrote: post #6

Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™. Nothing turns you off more from a conferencing solution than: any problem getting it working right now. When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective dis…

Zoom doesn't simply works. The same way that facebook isn't a good news feed. and paypal isn't a good, neutral, bank. etc etc.

But people (like you) unknowingly shill for them because they've feel prey to the marketing and influencers. Advertisement works. And you are living proof of that.