6 ms·

Why do these apps require installers at all? What are they installing—presumably any of their proprietary tech can run in userspace unprivileged. Personally, m

Why do these apps require installers at all? What are they installing—presumably any of their proprietary tech can run in userspace unprivileged. Personally, my best guess is because that’s the flow the product manager expected.

ryandrake 7y ago
The standard way to install an application on the Mac is to simply drag it into the Applications folder. That’s what is expected by users. For the vast majority of applications this should be enough. Whenever I see a Windows-style “installer” the first thing I think is... what kind of shenanigans are going on?
- em-bee 7y ago
  it's not like the app couldn't do those shenanigans when it's first started...
  - jjtheblunt 7y ago
    It would have to ask for Admin role to do so, though.
    - modeless 7y ago
      The installer has to ask too though, doesn't it? So using an installer still provides no benefit.
      - DavidSJ 7y ago
        Yes, but the point is that most Mac apps should need neither installer nor admin privileges.
      - jjtheblunt 7y ago
        I believe that (when I wrote and installer for internal use while at Apple) it needn't require admin to drop an app in, say, ~/Applications.
    - nsgi 7y ago
      Still plenty of evil things you can do without admin privileges, like running a server in the background that launches Zoom (as they tried previously).
- izacus 7y ago
  This standard way doesn't work in corp environments (which WebEx and Zoom are targeting primarily), where machines are remotely provisioned. For decent macOS remote installs and updates you need the PKG format scripts.
  - monadic2 7y ago
    What is so hard about remotely provisioning app bundles in a standard place? I ask because I have been tangentially involved in both image and script based provisioning and interacting with PKGs would seem to complicate, not simplify, both processes.
    - mschuster91 7y ago
      It's the processes. Every update will have to go through change requests, loads of approvals, ...
  - duskwuff 7y ago
    And the wacky PKG files used by Zoom (until recently) and WebEx are likely to be incompatible with those provisioning methods, because they don't unpack their contents and finish installing normally.
    - monocasa 7y ago
      They work just fine with the remote via Jamf or what have you. Deprovisionig might not work right, but that's rarely needed.
saagarjha 7y ago
With Zoom, apparently there's the app bundle, some browser plugins, and an audio kernel extension (the latter two of which are majorly deprecated?)
panic 7y ago
It seems unnecessary for core functionality at least -- I installed Zoom by unpacking the .app from the .pkg by hand (without running any installer scripts) and it works fine.
- figbert 7y ago
  Mind throwing me the name of or link to the program you used to unpack the .app? I'd like to do that myself, and remember stumbling on a program that did that, but can't recall the name.
  - Avery3R 7y ago
    7-Zip can do it on windows, maybe there's an osx port?
    - SturgeonsLaw 7y ago
      7-Zip, now there's a fantastic piece of software. It opens damn near everything, has an ultra-lightweight interface and doesn't have any near-malicious money grubbing schemes.
      - yrro 7y ago
        It's not safe to process untrusted files with 7zip https://news.ycombinator.com/item?id=16985460 https://news.ycombinator.com/item?id=16985460
    - 1123581321 7y ago
      7-zip is great. The Unarchiver is its equivalent on Mac. Suspicious Package is better for this particular file format because it shows what the installer will do, not just what it has in it.
      - yborg 7y ago
        Keka is my go-to for this, actively maintained by its author. https://www.keka.io/ https://www.keka.io/
ribosometronome 7y ago
Do these apps request accessibility permissions for screen sharing and the like during install?
- monadic2 7y ago
  I believe the privileged process requests this on use; I am not sure how you’d trigger it during install
lvillani 7y ago
Another reason could be to ensure that you have at most one copy of the application ever, since you can force it to install stuff always at the same location. On an unrelated product we learned that users ended up with many different copies of the app scattered throughout the system, if they were allowed to use the traditional bundle + DMG distribution method. Spotlight would then helpfully pick one random copy, with obvious consequences wrt. project file versioning. That is despite the DMG having the usual symlink to /Applications for a drag-and-drop installation.
- jcelerier 7y ago
  yes, it's a total pain. users send you a crash log, you see that they're on an old version, ask them to update. They say they do, you get the next crash log, and it's still the old version. And then you get a screenshot and you see 12 different versions of your .app, in the desktop, in ~/Applications, in /Applications...
  - nathancahill 7y ago
    Even worse when they don't copy it off the DMG. Just leave the DMG mounted.. forever.
    - berdario 7y ago
      Oh wow, I had no idea about the unintended consequences of the DMG + App bundle installation mechanism. Maybe the issue could be ameliorated with a self-updater built-in into the app? Not a separate daemon, but something that by running inside the app, would be able to know what's the path of the old version that should be thrown away.
      - ThePowerOfFuet 7y ago
        The de facto standard for this is Sparkle.framework, and it's excellent.
      - lvillani 7y ago
m463 7y ago
It's because they have specific strategic things they want to do. As an example, I noticed the Docker installer starts off doing telemetry before anything has been installed. Other less nefarious uses are to ask about telemetry / GDPR before installation. Apple documentation on installers specifically says -- you don't even have to have an installer. And most software really doesn't.
- monadic2 7y ago
  > Other less nefarious uses are to ask about telemetry / GDPR before installation. I’d imagine you’d want to gate this through the process itself to ensure users have actually accepted, especially as EULA enforceability varies from place to place.
teknologist 7y ago
What's more bizarre is that they have a fully functioning Chrome app that works almost just as well as the desktop client. It installs in a click and doesn't go through any sort of installation process.

ryandrake 7y ago

The standard way to install an application on the Mac is to simply drag it into the Applications folder. That’s what is expected by users. For the vast majority of applications this should be enough. Whenever I see a Windows-style “installer” the first thing I think is... what kind of shenanigans are going on?

em-bee 7y ago
it's not like the app couldn't do those shenanigans when it's first started...
- jjtheblunt 7y ago
  It would have to ask for Admin role to do so, though.
  - modeless 7y ago
    The installer has to ask too though, doesn't it? So using an installer still provides no benefit.
    - DavidSJ 7y ago
      Yes, but the point is that most Mac apps should need neither installer nor admin privileges.
    - jjtheblunt 7y ago
      I believe that (when I wrote and installer for internal use while at Apple) it needn't require admin to drop an app in, say, ~/Applications.
  - nsgi 7y ago
    Still plenty of evil things you can do without admin privileges, like running a server in the background that launches Zoom (as they tried previously).
izacus 7y ago
This standard way doesn't work in corp environments (which WebEx and Zoom are targeting primarily), where machines are remotely provisioned. For decent macOS remote installs and updates you need the PKG format scripts.
- monadic2 7y ago
  What is so hard about remotely provisioning app bundles in a standard place? I ask because I have been tangentially involved in both image and script based provisioning and interacting with PKGs would seem to complicate, not simplify, both processes.
  - mschuster91 7y ago
    It's the processes. Every update will have to go through change requests, loads of approvals, ...
- duskwuff 7y ago
  And the wacky PKG files used by Zoom (until recently) and WebEx are likely to be incompatible with those provisioning methods, because they don't unpack their contents and finish installing normally.
  - monocasa 7y ago
    They work just fine with the remote via Jamf or what have you. Deprovisionig might not work right, but that's rarely needed.

saagarjha 7y ago

With Zoom, apparently there's the app bundle, some browser plugins, and an audio kernel extension (the latter two of which are majorly deprecated?)

panic 7y ago

It seems unnecessary for core functionality at least -- I installed Zoom by unpacking the .app from the .pkg by hand (without running any installer scripts) and it works fine.

figbert 7y ago
Mind throwing me the name of or link to the program you used to unpack the .app? I'd like to do that myself, and remember stumbling on a program that did that, but can't recall the name.
- Avery3R 7y ago
  7-Zip can do it on windows, maybe there's an osx port?
  - SturgeonsLaw 7y ago
    7-Zip, now there's a fantastic piece of software. It opens damn near everything, has an ultra-lightweight interface and doesn't have any near-malicious money grubbing schemes.
    - yrro 7y ago
      It's not safe to process untrusted files with 7zip https://news.ycombinator.com/item?id=16985460 https://news.ycombinator.com/item?id=16985460
  - 1123581321 7y ago
    7-zip is great. The Unarchiver is its equivalent on Mac. Suspicious Package is better for this particular file format because it shows what the installer will do, not just what it has in it.
    - yborg 7y ago
      Keka is my go-to for this, actively maintained by its author. https://www.keka.io/ https://www.keka.io/

ribosometronome 7y ago

Do these apps request accessibility permissions for screen sharing and the like during install?

monadic2 7y ago
I believe the privileged process requests this on use; I am not sure how you’d trigger it during install

lvillani 7y ago

Another reason could be to ensure that you have at most one copy of the application ever, since you can force it to install stuff always at the same location. On an unrelated product we learned that users ended up with many different copies of the app scattered throughout the system, if they were allowed to use the traditional bundle + DMG distribution method. Spotlight would then helpfully pick one random copy, with obvious consequences wrt. project file versioning. That is despite the DMG having the usual symlink to /Applications for a drag-and-drop installation.

jcelerier 7y ago
yes, it's a total pain. users send you a crash log, you see that they're on an old version, ask them to update. They say they do, you get the next crash log, and it's still the old version. And then you get a screenshot and you see 12 different versions of your .app, in the desktop, in ~/Applications, in /Applications...
- nathancahill 7y ago
  Even worse when they don't copy it off the DMG. Just leave the DMG mounted.. forever.
  - berdario 7y ago
    Oh wow, I had no idea about the unintended consequences of the DMG + App bundle installation mechanism. Maybe the issue could be ameliorated with a self-updater built-in into the app? Not a separate daemon, but something that by running inside the app, would be able to know what's the path of the old version that should be thrown away.
    - ThePowerOfFuet 7y ago
      The de facto standard for this is Sparkle.framework, and it's excellent.
    - lvillani 7y ago

m463 7y ago

It's because they have specific strategic things they want to do. As an example, I noticed the Docker installer starts off doing telemetry before anything has been installed. Other less nefarious uses are to ask about telemetry / GDPR before installation. Apple documentation on installers specifically says -- you don't even have to have an installer. And most software really doesn't.

monadic2 7y ago
> Other less nefarious uses are to ask about telemetry / GDPR before installation. I’d imagine you’d want to gate this through the process itself to ensure users have actually accepted, especially as EULA enforceability varies from place to place.

teknologist 7y ago

What's more bizarre is that they have a fully functioning Chrome app that works almost just as well as the desktop client. It installs in a click and doesn't go through any sort of installation process.