44 ms·

Tell HN: Cisco WebEx on OS X uses the same pre-installer tricks as Zoom

673 points by mmastrac 7y ago

I noticed while installing WebEx today that the installer immediately terminated itself after popping up the pre-installation script. Running `strings` on the installation plugin (CWSPkgPlugin.bundle) shows why - it's using a similar process to what Zoom does [1] +[CWSUtilBase unzip:to:] /usr/bin/unzip Clean up temp unziped app done: %i unzip:to: [...] Cisco Webex pkg plugin, begin init work. Install CWS result: %i Launch CWS result: %i Terminate installer: %@ Terminate self: %@ [...] /usr/sbin/lsof forceTerminate Previously discussed here: https://news.ycombinator.com/item?id=22736608 https://news.ycombinator.com/item?id=22736608 [1] https://www.imore.com/zooms-preinstallation-script-workaround-macos-very-shady https://www.imore.com/zooms-preinstallation-script-workaroun...

x0x0 7y ago
Everyone who's spent 3 hours talking a parent through downloading and installing a Zoom client understands exactly why they're doing this. Mine are unable to (1) reliably download a zip file; (2) navigate to that file using Finder; (3) run something inside it. By the time we were done -- I use copilot (basically VNC with NAT punching built in) -- and I got control of the laptop to just do it myself, there were 7 downloads and 4 unzip attempts. My MIL and I have literally had facetime pointed at her laptop while I directed her where to to get copilot running for the quarterly cleansing-of-the-spyware.
- sprinfo 7y ago
  This is not a valid to excuse companies when they do this.
  - icelancer 7y ago
    For this forum, maybe not. For 99.9% of their userbase, it plainly is.
- wmf 7y ago
  If that problem exists it needs to be solved at the OS level, not worked around in shady ways. BTW, can't Web pages link to the app store?
  - icelancer 7y ago
    So you want Zoom and Webex to submit a patch to OSX?
    - wmf 7y ago
      I would say they should put pressure on Apple to make the install flow better, but what am I saying; this is Apple.
      - fierarul 7y ago
        Haha :) Tiny companies should put pressure on $1T Apple to change the install flow... I wonder how could Apple take 30% their revenue out of this -- yeah, by forcing them to submit the apps to the AppStore instead!
  - saagarjha 7y ago
    > BTW, can't Web pages link to the app store? Yes. But neither are distributed on the App Store, so…
- sigjuice 7y ago
  They need to do the work to get on the Mac App Store
  - x0x0 7y ago
    If Apple didn't make the app store shit, it would help. Gouging on dollars, breaking opening from Finder, etc.
    - sigjuice 7y ago
      These are free apps. And these apps deserve to have “breaking opening from Finder” and even more restrictions considering they have shown themselves to be completely untrustworthy, insecure, invasive and hostile.
      - x0x0 7y ago
        I had this problem with Office. Powerpoint had fidgety dialogs every time I wanted to open a pptx file from a different directory. I wasted two weeks, deleted it, and reinstalled from the direct download.
  - gamegod 7y ago
    The Mac App Store is a trap - The sandboxed APIs are severely limited, and no large company is going to let Apple get even more in-between them and their customers.
    - saagarjha 7y ago
      The sandboxed APIs should be more than enough for a video conferencing client. (Which, after all, can run in a browser…)
    - ken 7y ago
      First, they can use the sandbox without going through the Mac App Store. Sandboxing is a good idea regardless of distribution method. That would improve security for everybody, without needing to 'let Apple get in between them and their customers'. Second, Zoom already runs sandboxed for the other two ways you can run their client on Apple operating systems: the (iOS) App Store and the web. The Mac sandbox is the least strict of the three. So whatever they do, it doesn't seem to be hindered by 'severe limitations'. I have yet to hear any feature that a legitimate videoconferencing application would need that would be disallowed by the macOS sandbox. Lots of other video chat apps are on the Mac App Store, like Facebook Messenger. Is the issue simply that Zoom is being sketchy and wants to continue to be sketchy, and sandboxing would not allow them to? That's not because the MAS is 'a trap'. That's its main feature.
- amluto 7y ago
  And how exactly does this type of script help? The hard part is done before the script runs.
- pfranz 7y ago
  > My MIL and I have literally had facetime pointed at her laptop while I directed her where to to get copilot running for the quarterly cleansing-of-the-spyware. I haven't used it, but macOS does have screen sharing built into Messages.
- lathiat 7y ago
  While I agree with you that this aspect of Mac app installation is confusing (especially with Safari where your download just disappears into the top right toolbar) - they need to have figured that out before getting this far into the installer. Once your in the installer its all about hitting buttons.
- gnicholas 7y ago
  I used to do FT-on-iPhone-pointed-at-computer also. Now it's easy to do screen sharing via Messages (formerly iMessage). Comes with built-in audio also, so you don't even need to make a phone call.
- diebeforei485 7y ago
  Surely it would be easier for your parent / MIL to install from the Mac App Store.
- qwerty456127 7y ago
  This highlights a problem we should have addressed long ago - engineer a method to reliably educate old people about using modern computers so they could develop the same kind of intuitive understanding we have.
  - tonypace 7y ago
    That would be good, but it seems to take kids a few years to learn the ropes. I don't feel like older people have the patience or peer pressure. Would love to be proved wrong, though. I would have paid money to make that problem go away when I had it with Skype.
  - yjftsjthsd-h 7y ago
    User education does seem like a good solution to most of the problems being discussed, but that's certainly not a trivial thing to do, and I'm not 100% convinced that it can be fully solved. Learning to use a computer (well) is a decent amount of work.
- ThePowerOfFuet 7y ago
  The problem is that you don't even need this; use a conferencing solution that works in the browser, such as Whereby. It even works in Safari on an iPhone (!!!!!!).
  - noahtallen 7y ago
    zoom works in the browser, iirc
MR4D 7y ago
Isn’t all of this because of the Historical webRTC issues in safari?
- djrogers 7y ago
  In short, no.
  - MR4D 7y ago
    So, I was under the understanding that Safari was dragging their feet on the whole WebRTC thing, and if they had come out with it when Chrome did, that these types of apps would then be able to run in the browser (just like Jitsi does today, I presume). I know that companies have a perverse incentive to sell your info to advertisers and such, so I'm not trying to wave that away. Just wanting to understand if Safari DID have webRTC much earlier, would we be talking about Zoom today?
monadic2 7y ago
Why do these apps require installers at all? What are they installing—presumably any of their proprietary tech can run in userspace unprivileged. Personally, my best guess is because that’s the flow the product manager expected.
- ryandrake 7y ago
  The standard way to install an application on the Mac is to simply drag it into the Applications folder. That’s what is expected by users. For the vast majority of applications this should be enough. Whenever I see a Windows-style “installer” the first thing I think is... what kind of shenanigans are going on?
  - em-bee 7y ago
    it's not like the app couldn't do those shenanigans when it's first started...
    - jjtheblunt 7y ago
      It would have to ask for Admin role to do so, though.
      - modeless 7y ago
        The installer has to ask too though, doesn't it? So using an installer still provides no benefit.
        DavidSJ 7y ago
        Yes, but the point is that most Mac apps should need neither installer nor admin privileges.
        jjtheblunt 7y ago
        I believe that (when I wrote and installer for internal use while at Apple) it needn't require admin to drop an app in, say, ~/Applications.
fiddlerwoaroof 7y ago
I still don’t understand the issue with this: it’s not using this feature as intended, but they’re not exploiting any vulnerabilities or attempting to exploit a privilege escalation bug in macOS. Apple’s installers allow these scripts to do anything (and I believe there’s a prompt along the lines of “this installer will run a script to determine if the package can be installed”).
- cosmotic 7y ago
  They may not be exploiting vulnerabilities but they are breaking the contact with the expectations users have of how installers work.
  - pxtail 7y ago
    >with the expectations users have of how installers work Tbh I think that most people here on hn are experiencing cognitive bias because of additional knowledge - reality is that most of regular users do not give a damn about what installer does, they just want working app.
    - comex 7y ago
      But why are they even using Installer.app? First, why use an installer at all; second, if they really want an installer, why not make a custom installer app and avoid the "run a script" prompt? Installer.app doesn't have special privileges. Is the script approach just easier?
      - saagarjha 7y ago
        Enterprise deployment?
      - cosmotic 7y ago
        The built-in installer gives developers a lot of freebies like permission escalation and gets around "hey, you're trying to run a program from the internet" prompt. That is at least until developers start bending over backwards with crazy shell scripts like the one found in the zoom installer.
atarian 7y ago
The founder of Zoom used to work at WebEx before it was acquired. Wouldn't be surprised if he brought along some WebEx folks as well.
- cwilkes 7y ago
  I would love to see a lawsuit about stolen malware IP.
  - ddrt 7y ago
    Is it officially considered malware by apple? If so... feds don’t screw about. Those guys could be in serious trouble.
    - pubkraal 7y ago
      It was when they pushed the update to remove the zoom webserver.
    - vermilingua 7y ago
      Well then they’re lucky that law enforcement has a slightly more involved process to determine criminality than checking Apple’s malware filter list.
      - abduhl 7y ago
        But should they?
        some_random 7y ago
        Yes, I've always been a fan of not giving corporations the right to have people arrested and imprisoned without due process
- foobaw 7y ago
  the founder of zoom brought tons of people from WebEx (know someone who was part of the early webex team and now zoom)
wfbarks 7y ago
I hate it when the software I am trying to use installs itself on my computer after I click on it.
diebeforei485 7y ago
No wonder their uninstallation instructions[1] are hilariously complicated. They somewhat-helpfully point to an actual separate uninstaller package to download, but it doesn't even remove all the things mentioned on this page. 1. https://help.webex.com/en-us/WBX38280/How-Do-I-Uninstall-Webex-Software-on-a-Mac https://help.webex.com/en-us/WBX38280/How-Do-I-Uninstall-Web...
- oefrha 7y ago
  Having to download a separate uninstaller or having complicated uninstallation instructions does not in any way, shape, or form indicate there’s anything funny going on with the pkg installer. Any pkg installer (or any app bundle, if you want to completely remove all traces of it) would require a separate uninstaller to install, and any pkg installing to multiple directories will be complicated to uninstall, not even considering user data. lsbom | xargs rm is about as close as a native uninstallation method, but you will have user data and possibly things like launch agents left behind. The uninstallation page basically describes how to completely uninstall any nontrivial Mac application.
  - knome 7y ago
    That seems pretty ridiculous coming from Linux, where the vast majority of software will be installed via a package manager, making clean removal trivial. Under windows, I would consider any software that requires a separate removal tool to be suspect. Software wanting you to download a separate tool, fill out unavoidable surveys or linking you to a site to track uninstallations is all very seedy practices. Why isn't it expected of Mac software to keep an installation manifest and provide a way for removing the software?
    - zymhan 7y ago
      > Why isn't it expected of Mac software to keep an installation manifest and provide a way for removing the software? It is dead simple to remove a .app from the Applications folder. Sadly the pkg installers also throw files everywhere. Some software does include an uninstaller pkg, like Windows apps will include an uninstall.exe. But like windows, not everyone is meticulous about making sure you can uninstall cleanly.
chvid 7y ago
This is not malicious. This is simply easing up the installation process. If the files can be copied directly into applications then do so rather than trigger a password prompt. I would do the same.
emayljames 7y ago
The answer lies in zoom making a no-fuss-one-click installer and another full-winded-installer.
Bnshsysjab 7y ago
Has anyone checked that it doesn’t have the same uninstalled bugs? Namely the remote code exec rce that dropped a few months back..
qwerty456127 7y ago
I believe this is not hard to detect. Apple should detect this and report such an installer as particularly risky. Chances are the majority of installers working this way actually are malware, legitimate apps like Zoom and WebEx probably are exceptions.
- thu2111 7y ago
  That's extremely unlikely. Malware on macOS isn't prevalent. There is no market for anti-virus vendors on macOS, and Apple have been repeatedly tightening the approval process for macOS software. Gatekeeper only ever gets more aggressive, not less. Meanwhile videocall software is widespread, it's rapidly become a necessity for a large part of the world's population. I wouldn't be surprised if on macOS it's now in second place as a category behind web browsers. No. What Apple should, MUST do as quickly as possible, is understand and react to what developers here are trying to tell them - the usability of macOS software installation is terrible and no, the App Store is not an acceptable alternative. macOS software install UX is worse than Windows. It's worse than Android and iOS. It's better than Linux but that doesn't say much. If Apple want to end these practices, they need to deliver: 1. Genuine one or two-click install of software from the web, without the App Store being involved and without requiring sandboxing, allowing install scripts and for signed/notarised software, without any security popups. DMG style installs require drag and drop AND device unmounting, which isn't especially discoverable and hardly used on mobile platforms so some users can't figure it out (hence the reliance on PKG files). 2. Removal of the scary popup that Safari shows when a user clicks a non-http URL. Desktop software on macOS relies on these techniques because measuring the ratio of number of downloads to number of successful app starts shows that far fewer people make it through the process than they should, for instance, fewer than on Windows. This is a bit of an open secret in the desktop software world for many years now; Google for instance has detailed data on the problem. Each click you add causes the success rate to drop and macOS requires far more clicks than is justifiable. Additionally, the web server trick Zoom uses is because otherwise some non-trivial proportion of Safari users just automatically click cancel on the security popup when a web page tries to open a meeting, without even reading it. They don't understand what they're being asked or why, but figure if Apple want to double check with them it's safer to say no. Then they fail to join a meeting and if they're an important participant, that means the meeting fails for everyone. Note that this usability problem is Safari-specific. On other platforms and browsers such workarounds aren't needed. People need to stop giving Apple the benefit of the doubt here. Videoconf firms aren't doing this extra work because they're malicious or incompetent or because they inexplicably like doing work. They're doing it because otherwise a lot of Mac users fail to achieve the task they set out to do, and that hurts the usage of the video platform. It's ultimately Apple's problem to fix.
alkonaut 7y ago
This is apples fault. Not for not blocking it but for not making the download-and-installed as streamlined as it needs to be. Being forced to drag something to a folder is not the UX you expect.
- Cthulhu_ 7y ago
  Would distribution via the App Store work? I mean that is the easiest and most trustworthy way - from a consumer's point of view - to install software.
  - alkonaut 7y ago
    App store installs are easy. The difficult problem is making sure non-technical users can install and run binaries from untrusted third parties in basically a single click. Does that sound like a security nightmare? It is. But it's also the users' expectation of "just working".
- filleokus 7y ago
  As a Mac-user since the mid 2000's, that's exactly what I expect. Whenever I see an installer I know that it's some multiplatform/slightly crapware software I'm about to use.
Jonnax 7y ago
I was surprised that when I ran a WebEx exe on windows to join a meeting, after the meeting concluded a window appeared with my calendar information pulled from outlook. It really highlights how on desktop apps can do what they like. Whilst on mobile platforms at least you have to grant specific access.
- beardedscotsman 7y ago
  Webex can sync with your corporate calendar. Its possible by signing into Webex, it checked your corporation calendar and synced that. There is also a system with Webex, that is separate, and if you have Webex meetings registered against your email, it will provide you those meetings if you are not signed in.
  - 7777fps 7y ago
    I installed webex recently and was also surprised because I didn't even sign in to webex, I just ran it as "guest" and it still pulled across my calendar from outlook somehow.
- duxup 7y ago
  I'll admit as a web dev I sometimes take some of the "omg JavaScript" a little personally. Some of the usual pile on articles (granted their complaints aren't technically 'wrong') sometimes imply the browser is a bad place for a lot of things that are happening there privacy wise and etc. I always wonder ... "Uh, do you want platform specific desktop apps? You're not much better protected there man... and app availability becomes limited / a pain."
  - hitpointdrew 7y ago
    The answer is simple, just have server-side logic only! /s
  - asveikau 7y ago
    Well the zoom vulnerability from last year was a failure to consider full consequences of javascript. They thought binding a web server to localhost and having a browser make requests to it was OK. They did not consider that literally any other web page can make the same requests.
Cthulhu_ 7y ago
Why aren't more apps like Zoom and this one distributed via the app store? I mean besides the installer hackery they are legitimate and free apps right? Or would that mean that their premium services would require paying the fees to Apple, which they avoid this way?
- rwc 7y ago
  Because logging in, downloading and installing from the App Store is higher friction than how it works now. Typically Zoom is installed for the first time at the very moment a meeting is starting. Seconds matter.
- adwww 7y ago
  Can you even use the app store with a company mac? Who has the login - your personal account or some corporate one?
  - berdario 7y ago
    Good question, I think it should be the corporate one, and even if it might be a bit more work to setup, it's definitely in the company's interest, since then the applications that are installed can be sandboxed and be vetted/whitelisted more easily.
    - xnyan 7y ago
      App Store is disabled on my enterprise mac, same for my last job. I think it's fairly common.
      - adwww 7y ago
        Same as mine, but I didn't know if it was common or not.
  - IshKebab 7y ago
    Sure, you just make an account with your company email.
baxtr 7y ago
On top of that, WebEx quality is way worse than zoom
werber 7y ago
For work we’re in the process of switching from one to the other and the join meeting links on invites are now half functional on both. I wonder if this is the culprit
rayymlai 7y ago
The zoom guys are ex-WebEx guys. I saw the same zoom-bombing problem in WebEx few years back. we just enforce adding passcode/PIN to each meeting to remediate customer escalation.
Saaster 7y ago
I work in a tech company. The number of people you see who have their desktop filled with permanently mounted DMGs, launching their apps by opening said DMG and launching their trusty old Chrome version 53 by double-clicking the icon would blow your mind. Users don't use your software as you would like them to. Zoom now requires ~4 clicks to update when a new version is released as you click through the installer steps. You have to click the single frickin' disk icon (which is the only disk 99.9% of Apple users are going to have... still you have click on it) in one of the steps for the Next button to activate. Result: I fully expect a large percentage of the users to never update their Zoom successfully again. Great win for the users, the software which you downloaded, then clicked to install, no longer executes that scary pre-install script.
- KORraN 7y ago
  Not sure about what clicking disk icon you are talking about, but today's update showed up as regular pkg installer ("Next", "Next", "Accept", "Finish").
  - Saaster 7y ago
    Chrome uses an DMG, and the result is that people are using ancient versions of it straight out of their Downloads or Desktop folders. Zoom uses an .pkg, and have now removed the one-click install script. So every update to Zoom now runs through the same multi-step Next process as well (with one of the steps inactive until you select your disk, as is customary). If you think that isn't a problem for users, you've never walked grandma through the steps while she's trying to show her screen though the phone to you.
    - KORraN 7y ago
      I believe you that in some configurations you have to select a disk where you want update to be installed but in my case it's selected automatically so as I mentioned in the previous post, it's matter of clicking "Next" buttons.
- lonelappde 7y ago
feelapi 7y ago
cisco is not from China. Zoom is from China. End of story.
badrabbit 7y ago
Yeah and if webex suddenly got popular like zoom,it too will be massacared. This stuff is common. You know how many populat windows software acts bad? Filezilla's installer for example would literally install a very nasty strain of adware (to their credit, they give you the option to opt-out)

673 points by mmastrac 7y ago

x0x0 7y ago

Everyone who's spent 3 hours talking a parent through downloading and installing a Zoom client understands exactly why they're doing this. Mine are unable to (1) reliably download a zip file; (2) navigate to that file using Finder; (3) run something inside it. By the time we were done -- I use copilot (basically VNC with NAT punching built in) -- and I got control of the laptop to just do it myself, there were 7 downloads and 4 unzip attempts. My MIL and I have literally had facetime pointed at her laptop while I directed her where to to get copilot running for the quarterly cleansing-of-the-spyware.

sprinfo 7y ago
This is not a valid to excuse companies when they do this.
- icelancer 7y ago
  For this forum, maybe not. For 99.9% of their userbase, it plainly is.
wmf 7y ago
If that problem exists it needs to be solved at the OS level, not worked around in shady ways. BTW, can't Web pages link to the app store?
- icelancer 7y ago
  So you want Zoom and Webex to submit a patch to OSX?
  - wmf 7y ago
    I would say they should put pressure on Apple to make the install flow better, but what am I saying; this is Apple.
    - fierarul 7y ago
      Haha :) Tiny companies should put pressure on $1T Apple to change the install flow... I wonder how could Apple take 30% their revenue out of this -- yeah, by forcing them to submit the apps to the AppStore instead!
- saagarjha 7y ago
  > BTW, can't Web pages link to the app store? Yes. But neither are distributed on the App Store, so…
sigjuice 7y ago
They need to do the work to get on the Mac App Store
- x0x0 7y ago
  If Apple didn't make the app store shit, it would help. Gouging on dollars, breaking opening from Finder, etc.
  - sigjuice 7y ago
    These are free apps. And these apps deserve to have “breaking opening from Finder” and even more restrictions considering they have shown themselves to be completely untrustworthy, insecure, invasive and hostile.
    - x0x0 7y ago
      I had this problem with Office. Powerpoint had fidgety dialogs every time I wanted to open a pptx file from a different directory. I wasted two weeks, deleted it, and reinstalled from the direct download.
- gamegod 7y ago
  The Mac App Store is a trap - The sandboxed APIs are severely limited, and no large company is going to let Apple get even more in-between them and their customers.
  - saagarjha 7y ago
    The sandboxed APIs should be more than enough for a video conferencing client. (Which, after all, can run in a browser…)
  - ken 7y ago
    First, they can use the sandbox without going through the Mac App Store. Sandboxing is a good idea regardless of distribution method. That would improve security for everybody, without needing to 'let Apple get in between them and their customers'. Second, Zoom already runs sandboxed for the other two ways you can run their client on Apple operating systems: the (iOS) App Store and the web. The Mac sandbox is the least strict of the three. So whatever they do, it doesn't seem to be hindered by 'severe limitations'. I have yet to hear any feature that a legitimate videoconferencing application would need that would be disallowed by the macOS sandbox. Lots of other video chat apps are on the Mac App Store, like Facebook Messenger. Is the issue simply that Zoom is being sketchy and wants to continue to be sketchy, and sandboxing would not allow them to? That's not because the MAS is 'a trap'. That's its main feature.
amluto 7y ago
And how exactly does this type of script help? The hard part is done before the script runs.
pfranz 7y ago
> My MIL and I have literally had facetime pointed at her laptop while I directed her where to to get copilot running for the quarterly cleansing-of-the-spyware. I haven't used it, but macOS does have screen sharing built into Messages.
lathiat 7y ago
While I agree with you that this aspect of Mac app installation is confusing (especially with Safari where your download just disappears into the top right toolbar) - they need to have figured that out before getting this far into the installer. Once your in the installer its all about hitting buttons.
gnicholas 7y ago
I used to do FT-on-iPhone-pointed-at-computer also. Now it's easy to do screen sharing via Messages (formerly iMessage). Comes with built-in audio also, so you don't even need to make a phone call.
diebeforei485 7y ago
Surely it would be easier for your parent / MIL to install from the Mac App Store.
qwerty456127 7y ago
This highlights a problem we should have addressed long ago - engineer a method to reliably educate old people about using modern computers so they could develop the same kind of intuitive understanding we have.
- tonypace 7y ago
  That would be good, but it seems to take kids a few years to learn the ropes. I don't feel like older people have the patience or peer pressure. Would love to be proved wrong, though. I would have paid money to make that problem go away when I had it with Skype.
- yjftsjthsd-h 7y ago
  User education does seem like a good solution to most of the problems being discussed, but that's certainly not a trivial thing to do, and I'm not 100% convinced that it can be fully solved. Learning to use a computer (well) is a decent amount of work.
ThePowerOfFuet 7y ago
The problem is that you don't even need this; use a conferencing solution that works in the browser, such as Whereby. It even works in Safari on an iPhone (!!!!!!).
- noahtallen 7y ago
  zoom works in the browser, iirc

MR4D 7y ago

Isn’t all of this because of the Historical webRTC issues in safari?

djrogers 7y ago
In short, no.
- MR4D 7y ago
  So, I was under the understanding that Safari was dragging their feet on the whole WebRTC thing, and if they had come out with it when Chrome did, that these types of apps would then be able to run in the browser (just like Jitsi does today, I presume). I know that companies have a perverse incentive to sell your info to advertisers and such, so I'm not trying to wave that away. Just wanting to understand if Safari DID have webRTC much earlier, would we be talking about Zoom today?

monadic2 7y ago

Why do these apps require installers at all? What are they installing—presumably any of their proprietary tech can run in userspace unprivileged. Personally, my best guess is because that’s the flow the product manager expected.

ryandrake 7y ago
The standard way to install an application on the Mac is to simply drag it into the Applications folder. That’s what is expected by users. For the vast majority of applications this should be enough. Whenever I see a Windows-style “installer” the first thing I think is... what kind of shenanigans are going on?
- em-bee 7y ago
  it's not like the app couldn't do those shenanigans when it's first started...
  - jjtheblunt 7y ago
    It would have to ask for Admin role to do so, though.
    - modeless 7y ago
      The installer has to ask too though, doesn't it? So using an installer still provides no benefit.
      - DavidSJ 7y ago
        Yes, but the point is that most Mac apps should need neither installer nor admin privileges.
      - jjtheblunt 7y ago
        I believe that (when I wrote and installer for internal use while at Apple) it needn't require admin to drop an app in, say, ~/Applications.

fiddlerwoaroof 7y ago

I still don’t understand the issue with this: it’s not using this feature as intended, but they’re not exploiting any vulnerabilities or attempting to exploit a privilege escalation bug in macOS. Apple’s installers allow these scripts to do anything (and I believe there’s a prompt along the lines of “this installer will run a script to determine if the package can be installed”).

cosmotic 7y ago
They may not be exploiting vulnerabilities but they are breaking the contact with the expectations users have of how installers work.
- pxtail 7y ago
  >with the expectations users have of how installers work Tbh I think that most people here on hn are experiencing cognitive bias because of additional knowledge - reality is that most of regular users do not give a damn about what installer does, they just want working app.
  - comex 7y ago
    But why are they even using Installer.app? First, why use an installer at all; second, if they really want an installer, why not make a custom installer app and avoid the "run a script" prompt? Installer.app doesn't have special privileges. Is the script approach just easier?
    - saagarjha 7y ago
      Enterprise deployment?
    - cosmotic 7y ago
      The built-in installer gives developers a lot of freebies like permission escalation and gets around "hey, you're trying to run a program from the internet" prompt. That is at least until developers start bending over backwards with crazy shell scripts like the one found in the zoom installer.

atarian 7y ago

The founder of Zoom used to work at WebEx before it was acquired. Wouldn't be surprised if he brought along some WebEx folks as well.

cwilkes 7y ago
I would love to see a lawsuit about stolen malware IP.
- ddrt 7y ago
  Is it officially considered malware by apple? If so... feds don’t screw about. Those guys could be in serious trouble.
  - pubkraal 7y ago
    It was when they pushed the update to remove the zoom webserver.
  - vermilingua 7y ago
    Well then they’re lucky that law enforcement has a slightly more involved process to determine criminality than checking Apple’s malware filter list.
    - abduhl 7y ago
      But should they?
      - some_random 7y ago
        Yes, I've always been a fan of not giving corporations the right to have people arrested and imprisoned without due process
foobaw 7y ago
the founder of zoom brought tons of people from WebEx (know someone who was part of the early webex team and now zoom)

wfbarks 7y ago

I hate it when the software I am trying to use installs itself on my computer after I click on it.

diebeforei485 7y ago

No wonder their uninstallation instructions[1] are hilariously complicated. They somewhat-helpfully point to an actual separate uninstaller package to download, but it doesn't even remove all the things mentioned on this page. 1. https://help.webex.com/en-us/WBX38280/How-Do-I-Uninstall-Webex-Software-on-a-Mac https://help.webex.com/en-us/WBX38280/How-Do-I-Uninstall-Web...

oefrha 7y ago
Having to download a separate uninstaller or having complicated uninstallation instructions does not in any way, shape, or form indicate there’s anything funny going on with the pkg installer. Any pkg installer (or any app bundle, if you want to completely remove all traces of it) would require a separate uninstaller to install, and any pkg installing to multiple directories will be complicated to uninstall, not even considering user data. lsbom | xargs rm is about as close as a native uninstallation method, but you will have user data and possibly things like launch agents left behind. The uninstallation page basically describes how to completely uninstall any nontrivial Mac application.
- knome 7y ago
  That seems pretty ridiculous coming from Linux, where the vast majority of software will be installed via a package manager, making clean removal trivial. Under windows, I would consider any software that requires a separate removal tool to be suspect. Software wanting you to download a separate tool, fill out unavoidable surveys or linking you to a site to track uninstallations is all very seedy practices. Why isn't it expected of Mac software to keep an installation manifest and provide a way for removing the software?
  - zymhan 7y ago
    > Why isn't it expected of Mac software to keep an installation manifest and provide a way for removing the software? It is dead simple to remove a .app from the Applications folder. Sadly the pkg installers also throw files everywhere. Some software does include an uninstaller pkg, like Windows apps will include an uninstall.exe. But like windows, not everyone is meticulous about making sure you can uninstall cleanly.

chvid 7y ago

This is not malicious. This is simply easing up the installation process. If the files can be copied directly into applications then do so rather than trigger a password prompt. I would do the same.

emayljames 7y ago

The answer lies in zoom making a no-fuss-one-click installer and another full-winded-installer.

Bnshsysjab 7y ago

Has anyone checked that it doesn’t have the same uninstalled bugs? Namely the remote code exec rce that dropped a few months back..

qwerty456127 7y ago

I believe this is not hard to detect. Apple should detect this and report such an installer as particularly risky. Chances are the majority of installers working this way actually are malware, legitimate apps like Zoom and WebEx probably are exceptions.

thu2111 7y ago
That's extremely unlikely. Malware on macOS isn't prevalent. There is no market for anti-virus vendors on macOS, and Apple have been repeatedly tightening the approval process for macOS software. Gatekeeper only ever gets more aggressive, not less. Meanwhile videocall software is widespread, it's rapidly become a necessity for a large part of the world's population. I wouldn't be surprised if on macOS it's now in second place as a category behind web browsers. No. What Apple should, MUST do as quickly as possible, is understand and react to what developers here are trying to tell them - the usability of macOS software installation is terrible and no, the App Store is not an acceptable alternative. macOS software install UX is worse than Windows. It's worse than Android and iOS. It's better than Linux but that doesn't say much. If Apple want to end these practices, they need to deliver: 1. Genuine one or two-click install of software from the web, without the App Store being involved and without requiring sandboxing, allowing install scripts and for signed/notarised software, without any security popups. DMG style installs require drag and drop AND device unmounting, which isn't especially discoverable and hardly used on mobile platforms so some users can't figure it out (hence the reliance on PKG files). 2. Removal of the scary popup that Safari shows when a user clicks a non-http URL. Desktop software on macOS relies on these techniques because measuring the ratio of number of downloads to number of successful app starts shows that far fewer people make it through the process than they should, for instance, fewer than on Windows. This is a bit of an open secret in the desktop software world for many years now; Google for instance has detailed data on the problem. Each click you add causes the success rate to drop and macOS requires far more clicks than is justifiable. Additionally, the web server trick Zoom uses is because otherwise some non-trivial proportion of Safari users just automatically click cancel on the security popup when a web page tries to open a meeting, without even reading it. They don't understand what they're being asked or why, but figure if Apple want to double check with them it's safer to say no. Then they fail to join a meeting and if they're an important participant, that means the meeting fails for everyone. Note that this usability problem is Safari-specific. On other platforms and browsers such workarounds aren't needed. People need to stop giving Apple the benefit of the doubt here. Videoconf firms aren't doing this extra work because they're malicious or incompetent or because they inexplicably like doing work. They're doing it because otherwise a lot of Mac users fail to achieve the task they set out to do, and that hurts the usage of the video platform. It's ultimately Apple's problem to fix.

alkonaut 7y ago

This is apples fault. Not for not blocking it but for not making the download-and-installed as streamlined as it needs to be. Being forced to drag something to a folder is not the UX you expect.

Cthulhu_ 7y ago
Would distribution via the App Store work? I mean that is the easiest and most trustworthy way - from a consumer's point of view - to install software.
- alkonaut 7y ago
  App store installs are easy. The difficult problem is making sure non-technical users can install and run binaries from untrusted third parties in basically a single click. Does that sound like a security nightmare? It is. But it's also the users' expectation of "just working".
filleokus 7y ago
As a Mac-user since the mid 2000's, that's exactly what I expect. Whenever I see an installer I know that it's some multiplatform/slightly crapware software I'm about to use.

Jonnax 7y ago

I was surprised that when I ran a WebEx exe on windows to join a meeting, after the meeting concluded a window appeared with my calendar information pulled from outlook. It really highlights how on desktop apps can do what they like. Whilst on mobile platforms at least you have to grant specific access.

beardedscotsman 7y ago
Webex can sync with your corporate calendar. Its possible by signing into Webex, it checked your corporation calendar and synced that. There is also a system with Webex, that is separate, and if you have Webex meetings registered against your email, it will provide you those meetings if you are not signed in.
- 7777fps 7y ago
  I installed webex recently and was also surprised because I didn't even sign in to webex, I just ran it as "guest" and it still pulled across my calendar from outlook somehow.
duxup 7y ago
I'll admit as a web dev I sometimes take some of the "omg JavaScript" a little personally. Some of the usual pile on articles (granted their complaints aren't technically 'wrong') sometimes imply the browser is a bad place for a lot of things that are happening there privacy wise and etc. I always wonder ... "Uh, do you want platform specific desktop apps? You're not much better protected there man... and app availability becomes limited / a pain."
- hitpointdrew 7y ago
  The answer is simple, just have server-side logic only! /s
- asveikau 7y ago
  Well the zoom vulnerability from last year was a failure to consider full consequences of javascript. They thought binding a web server to localhost and having a browser make requests to it was OK. They did not consider that literally any other web page can make the same requests.

Cthulhu_ 7y ago

Why aren't more apps like Zoom and this one distributed via the app store? I mean besides the installer hackery they are legitimate and free apps right? Or would that mean that their premium services would require paying the fees to Apple, which they avoid this way?

rwc 7y ago
Because logging in, downloading and installing from the App Store is higher friction than how it works now. Typically Zoom is installed for the first time at the very moment a meeting is starting. Seconds matter.
adwww 7y ago
Can you even use the app store with a company mac? Who has the login - your personal account or some corporate one?
- berdario 7y ago
  Good question, I think it should be the corporate one, and even if it might be a bit more work to setup, it's definitely in the company's interest, since then the applications that are installed can be sandboxed and be vetted/whitelisted more easily.
  - xnyan 7y ago
    App Store is disabled on my enterprise mac, same for my last job. I think it's fairly common.
    - adwww 7y ago
      Same as mine, but I didn't know if it was common or not.
- IshKebab 7y ago
  Sure, you just make an account with your company email.

baxtr 7y ago

On top of that, WebEx quality is way worse than zoom

werber 7y ago

For work we’re in the process of switching from one to the other and the join meeting links on invites are now half functional on both. I wonder if this is the culprit

rayymlai 7y ago

The zoom guys are ex-WebEx guys. I saw the same zoom-bombing problem in WebEx few years back. we just enforce adding passcode/PIN to each meeting to remediate customer escalation.

Saaster 7y ago

I work in a tech company. The number of people you see who have their desktop filled with permanently mounted DMGs, launching their apps by opening said DMG and launching their trusty old Chrome version 53 by double-clicking the icon would blow your mind. Users don't use your software as you would like them to. Zoom now requires ~4 clicks to update when a new version is released as you click through the installer steps. You have to click the single frickin' disk icon (which is the only disk 99.9% of Apple users are going to have... still you have click on it) in one of the steps for the Next button to activate. Result: I fully expect a large percentage of the users to never update their Zoom successfully again. Great win for the users, the software which you downloaded, then clicked to install, no longer executes that scary pre-install script.

KORraN 7y ago
Not sure about what clicking disk icon you are talking about, but today's update showed up as regular pkg installer ("Next", "Next", "Accept", "Finish").
- Saaster 7y ago
  Chrome uses an DMG, and the result is that people are using ancient versions of it straight out of their Downloads or Desktop folders. Zoom uses an .pkg, and have now removed the one-click install script. So every update to Zoom now runs through the same multi-step Next process as well (with one of the steps inactive until you select your disk, as is customary). If you think that isn't a problem for users, you've never walked grandma through the steps while she's trying to show her screen though the phone to you.
  - KORraN 7y ago
    I believe you that in some configurations you have to select a disk where you want update to be installed but in my case it's selected automatically so as I mentioned in the previous post, it's matter of clicking "Next" buttons.
lonelappde 7y ago

feelapi 7y ago

cisco is not from China. Zoom is from China. End of story.

badrabbit 7y ago

Yeah and if webex suddenly got popular like zoom,it too will be massacared. This stuff is common. You know how many populat windows software acts bad? Filezilla's installer for example would literally install a very nasty strain of adware (to their credit, they give you the option to opt-out)