←back to thread

How the Zoom macOS installer does its job without you clicking ‘install’

(twitter.com)
796 points _Microft | 6 comments | 31 Mar 20 11:41 UTC | HN request time: 0.643s | source | bottom
Show context
manigandham ◴[31 Mar 20 14:48 UTC] No.22738023[source]▶
1) If Zoom can do this then it's a MacOS security bug.

2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI.

3) Malware is defined by what it does, not how it's installed.

replies(3): >>22738241 #>>22738342 #>>22741312 #
1. Gaelan ◴[31 Mar 20 15:19 UTC] No.22738342[source]▶
I mean, it's not really a security bug. Installer.app displays a dialog box that says "Hey, this package wants to run arbitrary code to check if it's compatible with your system. Is that OK?" The user is explicitly opting into the code execution. Zoom's "compatibility check" installs the app and kills the installer window. That's certainly unexpected behavior, but I don't think it's an exploit in any real sense.

While normally I'd object to running arbitrary code with just an easily-skippable dialog as confirmation, but I think it's OK in this case where the expectation was that we're installing their software anyway.

replies(3): >>22738808 #>>22742516 #>>22742693 #
2. manigandham ◴[31 Mar 20 15:56 UTC] No.22738808[source]▶
You're right, it's more of a design issue. More explicit permissions on altering the Applications folder could help. Then again, most people want an easier install so this is really for those who want that extra control.
3. etaioinshrdlu ◴[31 Mar 20 20:59 UTC] No.22742516[source]▶
It's really Apple's fault. "This package will run a program to determine if the software can be installed." Is just fundamentally a very strange statement to make, loaded with vagueness.

Think about your average user... they are running an installer program... which alerts them that they need to run another program... to determine if they can install the program.... (Which the user thought they were already doing)

The loaded expectation of the user to realize they are granting privileges to a program to determine whether they can install a program is just totally unreasonable.

It just sounds more and more ridiculous written out like this.

replies(1): >>22744086 #
4. opportune ◴[31 Mar 20 21:17 UTC] No.22742693[source]▶
As a user, I would not assume that checking compatibility means I'm executing arbitrary code. I mean it could just be macOS examining the binary to make sure it's compatible with my ISA, or checking some app metadata about recommended free resources like ram/disk space.
replies(1): >>22742815 #
5. pvg ◴[31 Mar 20 21:28 UTC] No.22742815[source]▶
Apple agrees with you which is why the installer shows a warning the check will involve running code and lets you opt in or out.
6. Smoosh ◴[31 Mar 20 23:46 UTC] No.22744086[source]▶
On top of this, a standard install asks for permissions, but doesn't disclose who/what is asking for it (certified in some way) or what permissions it wants, if these are temporary for the install or permanent for the application, or what it is going to do during the install (what goes where, what gets changed etc).

It is long past time for Apple to improve this process.