How the Zoom macOS installer does its job without you clicking ‘install’
twitter.com
twitter.com
This was a horrible user experience for me, and I wasn't thinking about security implications at all.
SuspiciousPackage wouldn't have helped combat Drunk Install Syndrome, but it might have been a helpful tool before I nuked my OS.
Or maybe this is just good marketing for SuspiciousPackage, which is really malware. Well played.
I've defended Zoom in the past for ethical 'slips', but weidly this has tipped me into hating it.
$ brew cask install zoomus $ brew cask uninstall zoomus
so long and thank you for all the fish... Zoom
Note: I have contributed casks to Homebrew Cask before.
brew analytics offPopcon is first-party, and is entirely opt-in. It doesn’t send anything unless you want it to.
It _is_ bad on macOS. It used to be one of the better platforms to stream video content to others, but now it just lacks in many areas compared to most of its competitors.
The worst bug I had was it essentially started muting random people on a call, but only for me. I could see their mouth moving, and thought it was a problem their side but turns out everyone else could hear them apart from me. I could hear everyone else too apart from them.
See previous “lets install a server on this Mac that is not removed when you uninstall the app and leaves your camera open to the entire internet” for more examples.
I use it on a VM, I suggest you do it too.
I was a big proponent when they started as appear.in, but they’ve been steadily removing features (or moving them to the paid plan). For my friend group, the biggest appeal was that you could use it in a browser without an account by inventing a room name. That was one of the first features to get cut.
Everyone I’ve ever recommended it to has bumped into the limitations, asked me “what happened”, and switched to something else.
I haven’t tried it extensively, but I’ve read about https://meet.jit.si/ on HN and passed it on to a friend in that situation. He was happy with it and described it as “what appear.in used to be”.
2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI.
3) Malware is defined by what it does, not how it's installed.
While normally I'd object to running arbitrary code with just an easily-skippable dialog as confirmation, but I think it's OK in this case where the expectation was that we're installing their software anyway.
Think about your average user... they are running an installer program... which alerts them that they need to run another program... to determine if they can install the program.... (Which the user thought they were already doing)
The loaded expectation of the user to realize they are granting privileges to a program to determine whether they can install a program is just totally unreasonable.
It just sounds more and more ridiculous written out like this.
It is long past time for Apple to improve this process.
Well, from the tweet thread:
> If the App is already installed but the current user is not admin, they use a helper tool called "zoomAutenticationTool" [sic] and the AuthorizationExecuteWithPrivileges API to spawn a password prompt identifying as "System" (!!) to gain root (including a typo).
Dropbox (used to?) patch system files to integrate with Office better, and that wasn't considered malware either.
By the time you're lying to the user, you are malicious.
Yes, zoom does need the user’s password to complete the install in the scenario described. So why isn’t there a proper installer that behaves like installers on macOS should. Why do they ask for the users password on the behalf of ‘system’?
Oh, and zoom was just busted for sending user data to Facebook (regardless of whether or not you had a Facebook account and without disclosure AFAIK) so I reverse my previous statement. It is malware.
https://twitter.com/c1truz_/status/1244737675191619584/photo...
This message is a lie; it not coming from system but from the installer script.
Just because the OS is used to show the dialog doesn't mean it should be trusted. As other commenter noted this could be used to steal passwords; that is effectively what it does.
https://apple.stackexchange.com/questions/344117/mac-10-13-1...
How is this different from the way e.g. Virtualbox gets root?
This is also a MacOS vuln that lets apps lie about their identity in sudo prompts, much like a browser showing an https site with no certificate checking.
How would you design this system?
I'm running Mavericks—the last version of macOS before they made the UI flat—and the prompt didn't look out of place. If Zoom is indeed faking the box, they actually went through the trouble to make a separate version for Mavericks with Mavericks-style visuals.
They should just kill the format. Everything should just be drag to install, drag to trash to remove.
It was actually a really beautiful synergy—you install applications by copying them to a folder, and launch them from that folder. Same way you'd acquire and open files. Lovely.
Then Apple ruined it in Lion with Launchpad. Their app install flow for anything outside of the app store doesn't make any sense.
though preferences files were a bit of a mess.
I vaguely remember if early Macintosh System versions you would be prompted to insert the disk (with the correct disk name in the message) if you tried to open a file belonging to an application which was on an ejected disk.
The DMGs are a clever way to (A) make sure the app gets to the proper location while simultaneously (B) teaching the user about what's actually happening on their computer. As I said in a sibling comment, this all made much more sense when users also launched apps from the Applications folder directly.
Some applications offer to move themselves to the /Applications folder when started the first time outside /Applications or ~/Applications. Though in general, it would be better if Apple made it more attractive to publish in the App Store, since it brings other advantages (e.g. mandatory sandboxing).
Also, personally, I sometimes purposefully put apps in places other than /Applications—for example, I like to keep games in their own Games folder. And then the dialogs are kind of annoying.
Mac is now Prosumers and Professionals. And its UX should be treated as such.
I wish it were that easy, most apps leave files in other places on your computer like ~/Library that will never get cleaned up if you just move the app to trash.
It might be nice if macOS had some sort of automatic cleanup routine when an app is trashed, but that would either require showing the user an extra dialog (a la AppCleaner's) or introducing an opaque system which could potentially lead to data loss.
But I think the primary argumentation in favor of what macOS does now on drag-to-trash is that the users preferences are preserved, for when they install an application again.
https://mobile.twitter.com/c1truz_/status/124473767519161958...
No it isn't. The dialog prompt is "System need your privilege to change." That's not passing QA anywhere -- it's just a custom message someone put into Zoom without bothering to proofread.
gksudo is definitely spoofable, except I almost never get a gksudo dialog. I am not trained to expect every other app to periodically ask me for my password.
Nothing turns you off more from a conferencing solution than: any problem getting it working right now.
When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective distain for the solution and video conferencing as a whole.
This extends to getting the solution working for greenfield installs as simple as possible. Because who knows which non-tech users from which department all need to join and can't figure out how to set the permission in their browser right or install/use the other browser that is compatible.
So sadly, from a functionality point of view, you want have the software be able to force itself onto the user in the most usable state it can.
In my experience (also not enterprise), Zoom is the simplest solution with the best quality and latency, compared to the alternatives. The UX could be better, but the performance of Zoom for all platforms makes you survive the UX.
hangouts can’t handle many users (is it 10 the limit?), which is a deal breaker for me. we’ve tried and people couldn’t join the call.
if by microsoft you mean teams, i’m not aware of it working without accounts (not an issue for google as most people have google accounts).
Also, I think it's possible for companies to disallow guest users on their team instance.
My company had a 17 person Hangouts (Meet) meeting on Monday. Actually, we switched to Hangouts from Slack because Slack has a 15 person limit.
Is the limit maybe different for "Hangouts" vs Hangouts Meet?
Actually I have to go out of my way to run Zoom in the browser instead of using the installer. I have to use Chrome instead of Firefox, download but not install the app and wait for the "or run in browser" link to appear after that.
I really don't like macOS installers anyways and passionately hate them as "installing" and App on macOS should be nothing more than moving the .app from a zip or disk image into your /Applications folder. I just don't trust them in not placing additional crap like auto updaters or kext's when I don't need them.
My wife was on a Teams videoconference last week. 125 people in four locations from New York to Southern California.
An hour into it, half of the people were simultaneously dropped, and not from any particular geography. It was random. And nobody could reconnect for a very long time. It took 45 minutes to restart the meeting.
The company is no longer using Teams.
Maybe this has changed since I last talked to Microsoft, but even their own team was unhappy with it. But if you still have access to broadcast.skype.com, it still works, until they decide it shouldnt.
IMHO.
I'm even uncomfortable with config scattered everywhere. The continued need for those 3rd party uninstallers is an admission of failure.
Source: released products ported to misc Windows, classic Mac, modern Mac. Our dev, QA, Test, tech supp was always so much easier on Mac. Not least because we could have multiple current versions installed. Which allows troubleshooting, rollbacks, etc.
Caveat: I personally use package managers and am curious to see if Nix becomes the norm. So I may change my mind in the future.
> to run Zoom in the browser [...] I have to use Chrome instead of Firefox.
Just a note, Slack and Teams calls also won't work in Firefox. It's really annoying.
Hangouts works fine in Firefox though, somewhat unexpectedly.
https://github.com/webcompat/web-bugs/issues/12975
And Teams calls:
https://github.com/webcompat/web-bugs/issues/25070
Slack originally relied on non-standard, Chrome-specific WebRTC behavior and now is prioritizing development of their Electron app over web support.
There is a Firefox extension to spoof Chrome's User-Agent string for Teams. I haven't tested it, but it appears to work for people: https://addons.mozilla.org/en-US/firefox/addon/teams-phone-f...
Also I regularly attend more than 50-person zoom calls without a hiccup. Google I think requires an enterprise plan to get to that limit, and I don’t even know what the name of their video conferencing product is at this point.
For Google, the answers are "sorta but not really", and "no":
https://support.google.com/meet/answer/9303164: "Note: Guests on the web don't need a Google account to participate in a meeting." The initiator of a meeting needs a G Suite account, but others can join without one.
https://gsuite.google.com/learn-more/security/security-white...: "Google does not collect, scan or use data in G Suite Core Services for advertising purposes."
(Speaking for myself, not Google.)
Gallery view does not exist in the web client. Nor the ability to add cat memes to your background.
I have the native client and it still shows me this option.
It can be enabled, but it's not on by default.
For one, Zoom did just work. (At least as a participant, rather than an organizer.) I tried it out, and it immediately worked. It did what all of us were expecting, with no fuss.
I also tried MS Teams. It seems designed with a different philosophy: that you use the software to do many different things, and you want them all integrated. (For example, it posted my meetings automatically to my Outlook calendar. I had never used this calendar before, and was only dimly aware that it existed.)
Moreover, it seems that the expected setup is a bunch of people, all at the same workplace, who communicate with each other consistently. My needs are different, with wildly disparate use cases: a departmental meeting; classes to teach; an online conference (https://www.daniellitt.com/agonize/); an online social gathering. Many of the people with whom I communicate don't work for the same employer. And I don't want to configure all of these "teams" in advance.
That said, I tried to get MS Teams up and running, to teach my class. This involved multiple emails back and forth to our tech support (it seems that I can't set up a "team" myself; I have to ask IT to do it for me). It didn't have its own whiteboard functionality so I had to download and run some separate software.
And, then, in the end... it didn't work. I was trying to teach a class, but my students couldn't see what I was doing. I had no idea why.
FWIW, IT can allow people in certain groups to make their own teams, it's an admin setting.
Makes using Teams quite a hassle, but with Skype for Business being the only other approved option for internal chat, it's better than nothing.
Completely free teams creation does come at a cost. It makes data governance much more complicated. People creating duplicate places for things they didnt know already existed. A lack of naming convention, to be able to analyze what exists. Microsoft is pushing for people to just be able to get things done, at the expense of organization.
I wish Microsoft would try a lot harder in persuading businesses to make the decision to take oauth approvals out of the user hands, because the volume is at a point where I really feel anyone following the "empower the user" discussion almost certainly has a compromised mailbox in their business.
Second, it does not support my browser.
That is not universally shared among others, including the non-technical folks that Zoom is being widely adopted by.
There's a parallels here with security in the uphill battle to get users to respect the caveats of the solution they choose.
Edit: downvoted for speaking up for student rights. Sorry if it is inconvenient for the teachers
This isn't true actually. As a student, send the following email:
"Hi Professor, I just read this webpage [link], which outlines some privacy concerns with Zoom. I know some other classes are running Software X, could we try that instead?"
My university isn't mandating Zoom. Indeed, they recommended several software packages, of which their top recommendation was Blackboard. (Which is what I've been using so far. I have mostly joined others' Zoom meetings; I've only initiated them for a D+D game I'm participating in.) MS Teams was their second recommendation as I recall, and Zoom was below that.
At least at my university -- and I expect that this is typical -- individual faculty members are deciding how to best fulfill their own responsibilities. And I have emphasized to my students that I have never done this before, and that I'm happy to change what I'm doing if people have good suggestions.
Hi [Student],
I appreciate your concern; however, our university has conducted a thorough audit of this software and found that it satisfies our needs. We will continue using it for our lectures.
Regards, Dr. [Professor]
Senior tenured chair of [Department], distinguished lecturer, [University]
Were you on a mac?
If so, you may have encountered https://answers.microsoft.com/en-us/msoffice/forum/msoffice_... which has been outstanding since October and has no sign will be fixed properly any time soon.
The workaround is quit programs until you find the one that somehow causes Microsoft Teams to not understand that it really does have permissions. For me it seemed to be XCode. But it could be others...here is a partial list:
- Harvest – Confirmed
- Sonos – Confirmed
- Cisco VPN – Issue reported by others
- Microsoft To-Do – Confirmed
- Contacts+ (formerly FullContact) – confirmed
- Apple Photos – confirmed
- Teamviewer – reported by others
- Prompt/popup for app review from App Store – still have questions here. This seemed to be it, but haven’t been able to confirm
- Brackets – reported by others
- Citrix Workspace Version: 19.10.2.41 (1910) – confirmed
But those products don't always "just work", at least not in my recent experience. I have had repeated problems with Google meetings while working with an external entity, and most of my employer is a Microsoft shop, so I've had deal with issues with both Teams and Skype, both via browser and OS X app.
The reason we ditched hangouts for zoom a few years ago was that hangouts only supported up to ten users, including users whose connection had died and so they had to re-enter the room again. This became extremely annoying - having to stop a conference mid-call to ask some people to disconnect so others could enter, or trying to find out how to kick "ghost" users, was definitely not "just works".
My company uses Zoom, and there have been many instances where, during a VTC call set up by someone at another company (that doesn’t use Zoom), we have switched mid-meeting to Zoom because there’s something wrong with the other VTC system (someone can’t join, can’t hear, can’t speak, can’t share their screen, etc.). And the other options haven’t gotten noticeably better over the years either.
Most people use the standalone app because indeed it "just works". That's why you don't hear much about its browser client.
Most people use the standalone app because Zoom aggressively pushes it.
Not for joining a meeting, no. You just type your name.
In my experience, every other solution I've tried is a train-wreck, compared to Zoom (MacBook Pro w/ external Apple monitors). And, as far as I remember, I've tried them all, repeatedly.
Even first-class platform-specific solutions like FaceTime are, basically, unusable vs. Zoom. Its amazing, actually. I'm not quite sure how Apple managed to make FaceTime's audio just not work (almost ever), and Zoom just works, every time, on every platform.
I'm also curious. I subscribed to Whereby (https://whereby.com/), where I can send people a URL, which they click and land in my conference room. There is ZERO software they need to install.
[For all the "well, actually" folks: yes, it "only" works in every modern browser out there, and it works "only" for up to 12 people. Fine with me.]
Zoom has more features, but there are many other solutions that work much better and are WAY simpler. It's just that Zoom is well known, and it's easiest to choose the tool that everyone has heard about.
- Install from App store
- Drag and drop the .app from zip/dmg
- Using a .pkg installer (mostly based on Xcode templates)
I'd argue that a lot of users don't know all of these and some even run most of their applications from the ~/Downloads folder.
Someone should make a PSA site that says something along the lines of “don’t install teleconferencing software because it usually bundles malware; your browser already has the technology built in.”
Maybe some incompatible software/hardware at some end? I don't know or even care really, but Jitsi worked well with the same participants both times, while the anecdotal Zoom success rate is still 0% for me.
But Jitsi is on my shortlist as I think being open source and self-hostable is the way forward for a tool that could knock Zoom of it's throne.
{edit} My experience: investor took over our startup, made us switch from bespoke technology to web-based conference features. Every feature was compromised, reliability and capacity reduced by 10X.
Also, Zoom has reached a critical mass where, particularly for sales calls, the remote party is quite likely to have it installed. The network effect here is really valuable.
Based on what I've seen, there's just so much hostile behaviour by the company (including lying about meeting HIPAA e2e requirements!) and the fact that their _official client_ had parts removed by the macOS malware removal tool that I just don't get why people still consider it as an option. If it were the only "just works" tool out there I'd understand, but there's plenty of competition in this space.
I've personally began using the Jitsi server the local student network association has set up and it's been working like a dream. You can even share a window to others (which I didn't even know browsers had support for) for presentations and such.
https://chrome.google.com/webstore/detail/google-meet-grid-v...
Which is even more infuriating because it shows that missing tiling in Meet is just a frontend issue.
I’m completely baffled that this is not implemented.
Zoom manages to run without crashing doesn't force me to close a browser and waiting a lot, so that's an advantage.
Zoom (if you need HIPPA) can set you up with it - but you WILL lose a bunch of features (zoom by default has features that are not HIPPA compatible) - so make sure you need HIPPA before paying for it.
If anything medicine is almost anti-e2e. Everything is copied and copied between one system and another (billing, lab systems, imaging systems etc). Seriously, medicine is in many cases very fragmented, so the number of medical practice groups that need copies of your details / visit details etc is high just to bill you (and you may end up with 5 bills for one visit - which may be 4-5 systems behind the scenes).
Zoom should definitely offer a Mac App Store version. Even if they just take their iPad app and Catalyst it, I'd probably use it.
It's up to the user's imagination to consider what a program can do.
The prompt is terribly worded though.
How do I know I’ve completely uninstalled all the things Zoom installed?
And, if Zoom provided a separate uninstaller (like many apps do) and it was verified to purge all of the stuff they installed (along with the uninstaller); would that appease people's concerns?
For now I’m sticking with the iOS app for video & their web-based experience for desktop sharing...
Oh, and there was a known vulnerability in the web server that allowed remote access to your camera. The company claimed this was all intentional and was a feature and refused to remediate it for months. Eventually Apple issues a system update that removed the web server.
https://www.buzzfeednews.com/article/nicolenguyen/zoom-webca...
I think a lot of power users rightfully feel they are belittled by sandboxes and application restrictions. But seeing that they are not the major userbase and most Apps don't really need any permissions at all for their intended purpose (the user's purpose at least) I think Apple is moving in the right direction.
If you prefer to remove it manually, here’s the list of files and folders Homebrew will delete on `brew cask zap zoomus`:
https://github.com/Homebrew/homebrew-cask/blob/a6026e0a36c22...
Running the uninstaller is enforced by the `pkg` declaration. See also: https://github.com/Homebrew/homebrew-cask/blob/a6026e0a36c22...
What is the typical install process for software on a Mac?
This is forming a troubling pattern [1]. Zoom will do anything to reduce the number of clicks to start a conference, even if results in a misleading installer prompt or security vulnerability.
[1]: https://www.zdnet.com/article/zoom-defends-use-of-local-web-...
As a customer this is a reason for me to stop using Zoom. Not in the last place because I'm quite sure we're only seeing the public tip of the iceberg of all the unacceptable things happening within Zoom.
Same with Uber, Google and bunch of other companies. It doesn't matter what they do, as their product is helping people enough for people to look past the terrible things.
You are wrong. Even without extensive experience in the space, you can very easily see how even large companies don't secure themselves at all. The US has had equifax recently, and it's not like that was an isolated example either. There just isn't a security culture at the eye-watering heights of corporate upper management and while everyone's as busy making money as they are, there never will be. It doesn't fit into the system, and anyone who tries to change it gets muscled out by people who don't want it to change - because that is simply what's most efficient.
However, they can be...enthusiastic when it comes to security around protecting themselves. If you report an issue with customer information on a public S3 bucket, they might get around to fixing it someday, but if there are "trade secrets" or the like in that bucket, the issue is going to get fixed immediately and someone with a big title probably won't be coming in tomorrow.
When I look at IT they give a damn about some security but then completely ignore other huge problems. I think a bigger concern for them is cost, liability and convenience for the administrators.
We already have meet.google.com that works well for us, and external clients can easily join through a web browser.
So why does no one care? Because Zoom UI/UX apparently works 100x better than most other solutions. People dont even REACT when I mentions Jitsi or just using the Teams solution that every Microsoft customer has anyways.
The enterprise I was talking about is using a mix of Microsoft Teams and Zoom. Our team started with Teams, now we are using Zoom because I don't even know. Others also move from Teams to Zoom.
I bring this up to lots of people and the response is rolling eyes and "shut the fuck up" in business euphemisms. Zoom is viral now and privacy has no say in its success.
So Teams is there, will stay there and it works well but people are still moving to Zoom anyways.
Google and Uber are already difficult to replace or to otherwise challange.
[1] https://news.ycombinator.com/item?id=22707528
Edit: Why downvote me? I am not trying to stir up flame wars. Saying anything against China has become impossible to do on HN. Voices get drowned despite of raising real legitimate concerns about privacy, especially for a tool used by millions all of a sudden during this pandemic. People should be speaking up on HN. I know, I am not supposed to complain about downvotes on HN, I've read the guidelines.
Edit2: Not able to find the source for Tianjin datacenter, I will reply if I can find it. Please take it with a grain of salt.
Edit3: Holyshit, so much attention on my comment. Redacting unsubstantiated claims and adding more sources that can be traced on the wikipedia section of Zoom privacy criticisms: https://en.wikipedia.org/wiki/Zoom_Video_Communications#Crit...
The post or the CNBC link don't seem to have the word Tianjin in them (comments do). Can you provide more details or another source?
If that's indeed true I won't be hopping on a Zoom call later this week with my bank for instance.
"China and Chinese companies have no real culture of user centric privacy."
Citation needed. That's one billion individuals you are talking about.
You can use HN Search to verify that HN sees plenty of comments "saying anything against China". The topic is extremely flame-prone because people are wont to hurl generalizations at each other, and worse. Nationalistic flamebait and flamewar is a big problem on HN [2] and destructive of the spirit of this site [1]. Individuals have been attacked here for just for expressing their views while being (or being assumed to be) Chinese, and at least one person was hounded off the site altogether. I'm sure you'll agree that that's shocking and not at all the community we want to be. None of us wants it, but it's easy to get it anyway, once such flames get going.
I don't think your comment was nationalistic flamebait, except insofar as it was rather unsubstantive. Unsubstantive comments on inflammatory topics are guaranteed to come across in a flamey way to some segment of the readership, even when that wasn't your intent. Intent doesn't communicate itself, unfortunately, so the burden is on the commenter to disambiguate [4].
[1] https://news.ycombinator.com/newsguidelines.html
[2] https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
[3] https://news.ycombinator.com/item?id=21200971
https://news.ycombinator.com/item?id=21195898
https://news.ycombinator.com/item?id=19404162
https://news.ycombinator.com/item?id=22608635
[4] https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
My macbook's bluetooth will not connect to my earbuds, but only when zoom is running. Other audio recording/playing apps don't affect things at all. What the heck is going on here?!
Scrolling on settings panels is definitely their own home-brewed scrolling functionality. Why?! Was macOS's not cutting it for some reason?
The settings menu is very clearly not using native OS buttons and inputs. Why?! Why build your own? What is that for?
that sounds like something related to this bug : https://www.jeffgeerling.com/blog/2018/airpods-get-stuck-low...
It seems like they've stuck their installation flow into an Installer.app _plugin_ which is unusual. I haven't encountered that before, and I'm somewhat surprised the feature exists considering Apple waged war on loading code into first-party software. (The user is prompted before the plugin loads.)
IMO the better question in this case is why Zoom needs to be installed as admin on MacOS? After all, the mobile apps and chrome extension don't need those privileges.
So in that case it seems like there is perhaps an issue on both sides.
- I understand that the OS API to get root/admin privileges likely exists for legacy app install reasons, but why should any install script even be able to run amok with admin privileges? Shouldn't privileges granted by this API this is using be sandboxed in the extreme? Something this sensitive shouldn't be left to the honor system of the app developer.
- Independently, I still don't understand why Zoom needs admin privs on Mac when it clearly doesn't need them when installed as a browser extension. I'm using it just fine in Chrome all the time - no admin rights needed.
First account I create on a new Mac: admin. Then, when setup is done, I login and create my non-admin user account.
This is a good reason for many reasons, this abusive installer being one.
They are aiming to make the process completely idiot proof, and good for them. If you’ve ever watched a nontechnical user try to install an application you’ll understand why they had to do all this.
I recently watched One of my friends who has only ever used an iPad and not a laptop try to install an application downloaded from the internet. Things we take for granted like “find your downloads folder” were not obvious. I had to explain what the Finder is, and it seemed laughably not obvious to someone who has never used it before.
Zoom doesn't want to use the stock H.264 encoder as provided by the browser for WebRTC communication. Instead, they use their own video encoders and decoders (which while still being H.264, it is presumedly better optimized for their use case). WebRTC forces you to use either the H.264 or the VP8 encoder/decoder that the browser provides.
How they do this is by having their own custom application that you have to install. Still, some users have noticed that there is a well hidden web-based version of Zoom, which works by again running their custom encoders, thanks to WebAssembly. Also it seems that their video is transmitted via DataCahnnels [0].
They are not alone. Companies want to provide additional "value" by innovating outside of what the WebRTC standard offers. That's nice and all, although it of course tends to disgregation and incompatibilities in the long run. For this reason, I've heard talks about how future revisions of the standard might explore adding WebAssembly support, in order to allow everyone embedding their own compiled components into their applications [1].
[0]: https://webrtchacks.com/zoom-avoids-using-webrtc/
[1]: https://webrtcbydralex.com/index.php/2019/11/13/webrtc-stand...
Having native code running in every client makes a service provider more valuable. It is much the same reason service providers would rather have you running their app on mobile than utilizing the web browser.
This link provides a bit of background to the webrtchack articles above and give a bit of background to when WebRTC is sufficient:
With this trick you can join Zoom calls without ever installing the client on your computer.
Here's how to do it:
1) Uninstall the Zoom client if you have it installed (this is important).
2) When you get a Zoom link to join a meeting, click it to open it in your browser.
3) You'll be asked to download Zoom. Click the "download & run Zoom" link, but don't run the installer.
4) Wait for a few moments and a link to "join from your browser" will appear. Click this and join the call as normal. Most of the features work in this browser based version -- there is no need to ever risk your computer!
Here's a gif demoing what to click: https://assets.zoom.us/images/en-us/web/client/join-web-clie...
Also, what happened to just dragging the program into the applications folder? I really liked that way of installing apps, but most things seems to have an annoying click-through wizard.
https://macpkghallofshame.tumblr.com/post/138612887932/indis...
Seriously, despite this person's aversion to anything Google, Hangouts ends up being the one tolerable exception.
But they won’t spend 5 minutes installing software properly, or half an hour doing some legwork.
They expect meeting chat software to just work and be as easy as opening a link. If a person needs to fly somewhere they have limited choices with airlines, but if a person gets frustrated with video conferencing software then they have an abundance of alternative options.
What's wrong with dragging .apps? Does your app really need to spread its tentacles beyond an app bundle and (maybe) some preference files?
Widespread use of Zoom for online education during the novel coronavirus pandemic increased concerns regarding students' data privacy and, in particular, their personally identifiable information.[17] According to the FBI, students’ IP addresses, browsing history, academic progress, and biometric data may be at risk during the use of similar online learning services.[17] Privacy experts are also concerned that the use of Zoom by schools and universities may raise issues regarding unauthorized surveillance of students and possible violations of students’ rights under the Family Educational Rights and Privacy Act (FERPA)
- Wikipedia
Given their security issues as of late, is there further way I could ensure that my machine has completely removed this software?
[0]
(I am not arguing in favor of the practice, just stating the advantage)
I love creative uses of language like this!
Be right back, I just have to optimize install conversions of my botnet client.
My company has been using Gotomeeting for 5+ years. No video (thankfully), but meetings are generally 20-30 people and largely seamless.
It is expensive: $300 per seat to host a meeting, but it pretty much just works. The UI is annoying and could be simpler.
However, I don't know if it is as shady as Zoom because I don't think anyone has done a deep dive.
Reminds me of tech support XD
An admin can write to /Applications without privilege escalation? That's a macOS bug. If the operating system didn't rely on an 80s-style put-all-the-executables-in-one-place app launch paradigm, maybe there'd be less incentive for app developers to ignore the per-user Applications folder that macOS supports.
An app can spoof or abuse privilege escalation dialogs? That's because macOS doesn't implement an Orange Book-style Trusted Path. It's why Windows and similar operating systems have secure attention keys in the first place.
So yeah, Zoom is (ab)using flaws in macOS to get itself installed with minimum fuss, but it isn't doing it with evil intent. They fixed past issues; they'll probably fix this. Meanwhile, these long-standing macOS security flaws won't be addressed by Apple, who has a terrible track record about these things except when it lets people bypass their App Store.
P.S. As an enterprise customer, I'm much more worried about end-to-end encryption in Zoom, and the apparent lack thereof. I'm also not sure how that compares with other video conferencing services.
But... why? What other software vendors look at the OS security model from a viewpoint of 'how do we bypass this as much as possible?' If it's not evil intent, what is it, incompetence?
Users don’t like UAC or having to click through a dozen dialogs. They just want to get into their virtual meeting.
Zoom does this somehow and doesn't make joining from the web frictionless when they pretty much could have.
So yes, there is some blame to be laid at the OS for running binaries with the privileges the current user has, but it's clear that the installer doesn't behave like a regular installer would.
/Applications has been root:admin 775 since forever ago. It’s not a bug, and drag this app to (an alias of) /Applications is very standard behavior of dmg installers. Working as designed.
The situation here is an admin explicitly executing a program that writes to a directory that they have write access to.
Edit: corrected typo 755 => 775.
Edit 2: Okay, I read what you wrote again and can now see I misunderstood. However,
1. macOS is primarily single user (or at least single household) given how it's actually used. In actual multiuser settings admins don't typically muck around with their admin account.
2. Typically other users can read/execute a lot of stuff that's not root anyway. For instance, on research group Linux servers people would often tell you to just execute something in their home directory.