How the Zoom macOS installer does its job without you clicking ‘install’

I installed Zoom on macOS yesterday and I thought that the install was crashing because this is not the expected behavior. I would double click the download, try to install, and then the installation program would "crash", so I'd try it again. Did that a few times before I realized it was installed. Until now I thought it had somehow gotten far enough in the installation process before crashing that I could at least use the application. I'd been hearing everyone raving about how Zoom was such better software than anything else, and my first experience was their installer doesn't even work.

This was a horrible user experience for me, and I wasn't thinking about security implications at all.

Same here. I thought the process didn't finish until I tried launching the app (which I was supposed to do by clicking a link in the browser, which is also rather unintuitive).

I would highly recommend checking all installers on macOS through Suspicious Package. It will give you a complete picture of all the installer scripts that will be run and all the files that will be written. I did just that for zoom and decided against installing it.

https://mothersruin.com/software/SuspiciousPackage/ for those curious

Oooh this is good. A few years ago I came home drunk and wanted to watch this old film that wasn't on any channels. I found it on some dubious website, which required me to install a player .dmg. I drunkenly typed in my password, and then an hour later was like: dafuq did I just do?!? Next day I re-imaged my mac because I'm both paranoid and don't know enough about secops.

SuspiciousPackage wouldn't have helped combat Drunk Install Syndrome, but it might have been a helpful tool before I nuked my OS.

Or maybe this is just good marketing for SuspiciousPackage, which is really malware. Well played.

I did this too and didn't put two and two together til now. I just assumed it was a buggy installer that broke with that version of MacOS and tried a different machine

I've defended Zoom in the past for ethical 'slips', but weidly this has tipped me into hating it.

Ok this is it... I was able to disinstall it with

$ brew cask install zoomus $ brew cask uninstall zoomus

so long and thank you for all the fish... Zoom

Similar functionality: unpkg (https://www.timdoug.com/unpkg/). See also https://stackoverflow.com/questions/11298855/how-to-unpack-a... . I think unpkg handles mpkg files, which I haven't encountered in the wild for quite a while now; I don't know about the others.

You can also use “brew cask zap zoomus” to remove preference files, browser plugins, logs.

Does this also work for non-brew installs?

Homebrew Cask's uninstall scripts are basically a community-maintained "best guess" at to how to full uninstall each piece of software. It's generally pretty reliable, and I do use it to remove non-brew installs sometimes.

Note: I have contributed casks to Homebrew Cask before.

I too don't get how Zoom is considered "the superior software". Maybe the calls don't drop, but the experience is bad (at least on macOS).

Said this on Reddit the other day and got downvoted.

It _is_ bad on macOS. It used to be one of the better platforms to stream video content to others, but now it just lacks in many areas compared to most of its competitors.

The worst bug I had was it essentially started muting random people on a call, but only for me. I could see their mouth moving, and thought it was a problem their side but turns out everyone else could hear them apart from me. I could hear everyone else too apart from them.

Yes. My experience is really bad too in mac OS. I thought may be something wrong with my setup.

Pacifist is also handy https://www.charlessoft.com/

If you don’t trust SuspiciousPackage just run it through SuspiciousPackage.

Presumably if you don't like Zoom's shadiness, you may not like Homebrew's bundled spyware either. Disable it with

    brew analytics off

Or better yet, switch to MacPorts - https://www.macports.org/

You can add `--force` and zap will also work on non-brew installs. The paths are community-contributed, so watch out (you can print the paths with `brew cask cat <name>`).

Isn't that more like Debian popularity contest ?

https://popcon.debian.org/

popcon is opt-in.

No. Homebrew sends a per-installation unique identifier to a third party (Google), tracking your location across different IPs, whether you want it to or not.

Popcon is first-party, and is entirely opt-in. It doesn’t send anything unless you want it to.