6 ms·

Wow that is really damning, trashing user security in trade to remove a single click that makes it clear as to what is happening. This totally breaks Apple's D

Wow that is really damning, trashing user security in trade to remove a single click that makes it clear as to what is happening. This totally breaks Apple's Developer Terms right?

vbezhenar 7y ago
How is it trashing user security?
- ghostpepper 7y ago
  By running a web server with the ability to circumvent installation? It could almost be considered a backdoor
  - vbezhenar 7y ago
    User willingly installs their software, they are not backdooring it. There are plenty of services running on every computer, including TCP servers and web servers. If you're going to call them backdoors, you've got a long list.
    - ghostpepper 7y ago
      If I think I have installed your software and it's secretly running a web server with the ability to reinstall itself, I am calling it a backdoor. I think that list is pretty short, but perhaps I am wrong.
- goerz 7y ago
  I don't think I understand the security implications of this either. Seems distasteful, but how could it be exploited?
  - sabbour 7y ago
    https://www.wired.com/story/zoom-bug-webcam-hackers/ https://www.wired.com/story/zoom-bug-webcam-hackers/
- dpkonofa 7y ago
  Look at what just happened with Zoom. The web server could be used by a malicious third-party to gain access to the system.
scarface74 7y ago
There are no “developer terms” that developers have to abide by for the Mac.
- ceejayoz 7y ago
  I'm fairly certain you have to agree to some to join the Apple Developer Program, which is (sort-of) required if you want people to be able to run your app.
  - scarface74 7y ago
    You don’t have to be in the developer program ftp distribute your app on the Mac.
    - ceejayoz 7y ago
      Technically? No. It'll largely refuse to run ("App can't be opened because it is from an unidentified developer") if it's not signed via Gatekeeper, though. There's a procedure to bypass that, but it's hardly user-friendly. https://support.apple.com/kb/ph25088?locale=en_US https://support.apple.com/kb/ph25088?locale=en_US
      - scarface74 7y ago
        Yes control click is really complicated.
        ceejayoz 7y ago
        First, the dialog doesn't give any indication it can be bypassed in that fashion. Second, users should rightfully be suspicious of "just bypass the security!" install instructions - especially non-technical ones.
        scarface74 7y ago
        Because users got a lot of security installing Zoom and BlueJeans since it was signed.... This isn’t unique to these two. Dropbox does some ungodly things when installed on the Mac....
josteink 7y ago
> Wow that is really damning, trashing user security in trade to remove a single click As someone who has had to develop and maintain a similar web-to-desktop bridge I can tell you that this one issue was responsible for around 90% of my company’s total support requests, despite only being a small feature in a optional addon in one of our main products. For businesses just trying to keep their customers happy, this particular one click is a very real problem. I can absolutely symphetize with people trying to come up with workarounds.
- tobr 7y ago
  That is interesting. What were the support requests, how to remove the confirm step, or what to do if you denied it but didn’t mean to? Or something else?
  - josteink 7y ago
    Most desktop-browsers have in the name of security made it exceptionally hard to accidentally launch external programs through this mechanism. We’re talking software engineering phd can’t complete it without hand-holding hard (true story!) So normal users definitely don’t understand nor manage to navigate the dialogs presented by the browser to produce a “successful” outcome. In the past we used this mechanism to “automatically” provide configuration-data a desktop component, so that it could call back to our application. And our users just didn’t manage to configure it. In the name of security, browsers made one path so hard to use, without considering what people would then develop instead. And here we are now. Oops!
    - dpkonofa 7y ago
      I have to call BS on this. Are you claiming that users can't complete a single prompt of "[Your browser] needs to open an external application to follow this link. (Decline) (Launch Application)"? That seems really unlikely. I've done enough user testing to, at least anecdotally, say with some certainty that this is not true.
      - 7y ago

Wow that is really damning, trashing user security in trade to remove a single click that makes it clear as to what is happening. This totally breaks Apple's Developer Terms right?

vbezhenar 7y ago

How is it trashing user security?

ghostpepper 7y ago
By running a web server with the ability to circumvent installation? It could almost be considered a backdoor
- vbezhenar 7y ago
  User willingly installs their software, they are not backdooring it. There are plenty of services running on every computer, including TCP servers and web servers. If you're going to call them backdoors, you've got a long list.
  - ghostpepper 7y ago
    If I think I have installed your software and it's secretly running a web server with the ability to reinstall itself, I am calling it a backdoor. I think that list is pretty short, but perhaps I am wrong.
goerz 7y ago
I don't think I understand the security implications of this either. Seems distasteful, but how could it be exploited?
- sabbour 7y ago
  https://www.wired.com/story/zoom-bug-webcam-hackers/ https://www.wired.com/story/zoom-bug-webcam-hackers/
dpkonofa 7y ago
Look at what just happened with Zoom. The web server could be used by a malicious third-party to gain access to the system.

scarface74 7y ago

There are no “developer terms” that developers have to abide by for the Mac.

ceejayoz 7y ago
I'm fairly certain you have to agree to some to join the Apple Developer Program, which is (sort-of) required if you want people to be able to run your app.
- scarface74 7y ago
  You don’t have to be in the developer program ftp distribute your app on the Mac.
  - ceejayoz 7y ago
    Technically? No. It'll largely refuse to run ("App can't be opened because it is from an unidentified developer") if it's not signed via Gatekeeper, though. There's a procedure to bypass that, but it's hardly user-friendly. https://support.apple.com/kb/ph25088?locale=en_US https://support.apple.com/kb/ph25088?locale=en_US
    - scarface74 7y ago
      Yes control click is really complicated.
      - ceejayoz 7y ago
        First, the dialog doesn't give any indication it can be bypassed in that fashion. Second, users should rightfully be suspicious of "just bypass the security!" install instructions - especially non-technical ones.
        scarface74 7y ago
        Because users got a lot of security installing Zoom and BlueJeans since it was signed.... This isn’t unique to these two. Dropbox does some ungodly things when installed on the Mac....

josteink 7y ago

> Wow that is really damning, trashing user security in trade to remove a single click As someone who has had to develop and maintain a similar web-to-desktop bridge I can tell you that this one issue was responsible for around 90% of my company’s total support requests, despite only being a small feature in a optional addon in one of our main products. For businesses just trying to keep their customers happy, this particular one click is a very real problem. I can absolutely symphetize with people trying to come up with workarounds.

tobr 7y ago
That is interesting. What were the support requests, how to remove the confirm step, or what to do if you denied it but didn’t mean to? Or something else?
- josteink 7y ago
  Most desktop-browsers have in the name of security made it exceptionally hard to accidentally launch external programs through this mechanism. We’re talking software engineering phd can’t complete it without hand-holding hard (true story!) So normal users definitely don’t understand nor manage to navigate the dialogs presented by the browser to produce a “successful” outcome. In the past we used this mechanism to “automatically” provide configuration-data a desktop component, so that it could call back to our application. And our users just didn’t manage to configure it. In the name of security, browsers made one path so hard to use, without considering what people would then develop instead. And here we are now. Oops!
  - dpkonofa 7y ago
    I have to call BS on this. Are you claiming that users can't complete a single prompt of "[Your browser] needs to open an external application to follow this link. (Decline) (Launch Application)"? That seems really unlikely. I've done enough user testing to, at least anecdotally, say with some certainty that this is not true.
    - 7y ago