News for hackers. Stuff that matters.
Re:Zoom has a signed binary that runs any unsigned script by gregoriol on Wednesday April 01, 2020 @07:36AM (#22747640)
Now that it's clear that Zoom developers do their best to do the worst, Apple should ban it entirely from their platforms
Re:Zoom has a signed binary that runs any unsigned script by HumblyTossed on Wednesday April 01, 2020 @08:01AM (#22747789)
They can't. Not now at least. For better or worse, people all over are using Zoom to stay in contact. If Apple banned it, it would be extremely difficult for them to not take a PR hit right now.
Re:Zoom has a signed binary that runs any unsigned script by ratww on Wednesday April 01, 2020 @08:17AM (#22747868)
Instead of banning, Apple should be working together with them to understand why they're resorting to such ugly hacks just to improve the installation UX, and use that feedback to improve macOS instead.
Re:Zoom has a signed binary that runs any unsigned script by Longhanks on Wednesday April 01, 2020 @11:09AM (#22749424)
The installation UX needs not be improved. It needs the holes Zoom abused fixed, so that it can no longer circumvent asking for the user's final consent. There is absolutely no reason Zoom should get away with intentionally abusing the platform they're given.
Re:Zoom has a signed binary that runs any unsigned script by jcelerier on Wednesday April 01, 2020 @01:03PM (#22750943)
> It needs the holes Zoom abused fixed, so that it can no longer circumvent asking for the user's final consent.

but... installing zoom is already asking for my consent, through an OS prompt. Do you want to have to type your user password two times for every app you install or what ?

Re:Zoom has a signed binary that runs any unsigned script by randoglando on Thursday April 02, 2020 @01:14AM (#22756407)
It could prevent an app from posing as "System" in the prompt for starters.
Re:Zoom has a signed binary that runs any unsigned script by ratww on Saturday April 04, 2020 @09:53PM (#22783105)
It needs both.
Re:Zoom has a signed binary that runs any unsigned script by aledthemathguy on Wednesday April 01, 2020 @08:18AM (#22747871)
1. Built an app that violates every security concern. 2. Gain massive traction because of its easy-of-use ("it just works"). 3. Become ubiquitous. 4. Fix the security bugs. 5. You won.
Re:Zoom has a signed binary that runs any unsigned script by e12e on Wednesday April 01, 2020 @10:06AM (#22748567)
I'm afraid step 4 is optional.
Re:Zoom has a signed binary that runs any unsigned script by gtirloni on Wednesday April 01, 2020 @07:51AM (#22747738)
If I buy an Apple device, it's mine, not Apple's to decide what I run on it.
Re:Zoom has a signed binary that runs any unsigned script by ookdatnog on Wednesday April 01, 2020 @08:52AM (#22748035)
But Apple does, in fact, decide what you can run on your device, at least on iPhones. That's _the_ primary reason why I never even considered buying one.

In fact I never understood why the HN crowd finds this policy so inoffensive. I've always considered it a massive intrusion on computing freedom.

Re:Zoom has a signed binary that runs any unsigned script by bitwize on Wednesday April 01, 2020 @09:27AM (#22748260)
Because it's not the 1980s anymore, and the thinking around security is different today. Running arbitrary code was mostly fine on 8- and 16-bit micros not connected to a global network, but today we need some sort of attestation that the code we run is trustworthy, otherwise it must be assumed not trustworthy. Code signing plus whitelisting -- the App Store model -- is one of the easiest ways to provide some degree of assurance of a program's trustworthiness.
Re:Zoom has a signed binary that runs any unsigned script by ookdatnog on Wednesday April 01, 2020 @06:18PM (#22754089)
I'm not arguing against whitelisting/curation. I'm arguing against forbidding your users to install anything that's not on the whitelist.

I find it really shocking that "it is ok for a single entity to decide which software you can run on a device you own, with no accountability whatsoever", is now apparently a mainstream opinion on a tech forum. And more disturbingly, you make your case by arguing against the very notion of broadly-available general-purpose computing.

Re:Zoom has a signed binary that runs any unsigned script by jakear on Wednesday April 01, 2020 @09:22AM (#22748233)
If I can’t decide what I can run on my iPhone, then bad actors like Zoom can’t expect me to sideload their product. Everybody must go through apple’s flow, nobody can strongarm users into sideloading this kind of shit.

It comes down to how you perceive the technology. My MacBook Pro is a tool I use for work that needs to be highly flexible and configurable, so I’m willing to work to maintain it. My iPhone is a convenience. I will not put work into maintaining a convenience, that defeats the point.

Others view their phones differently, they may elect for more configuration at the expense of maintenance burden. That’s their choice to make. I for example view the idea of wanting to root ones phone to be absolutely insane.

Re:Zoom has a signed binary that runs any unsigned script by ookdatnog on Wednesday April 01, 2020 @06:07PM (#22754013)
Interesting take. I always pictured my phone as a computing device, even though I don't use it like one really. Nevertheless I'm wary about giving up freedoms, even the ones I don't use. I'd say I mostly worry about slippery slopes.

I use Linux as my main OS even though I don't really customize it that much and never looked at the source code, because I think it's important that critical infrastructure (as operating systems are) should be open. I don't use Spotify, not because I think it's too expensive or inconvenient, but because I worry that the convenience of streaming can train us to not insist on our freedom to listen to music in DRM-free formats (I don't know if it exists already, but I kind of expect platform-exclusive music to be a thing soon). I use Firefox, not because I think it's better than Chromium but because I want to help avoid Google completely dominating the web, even at its endpoints, etc etc.

In the iPhone case, my worry is that if people get used to a smartphone not being a general purpose computing device, they can also be trained to view their laptop that way. I hope I don't need to argue why that would be a bad thing.

Re:Zoom has a signed binary that runs any unsigned script by jakear on Wednesday April 01, 2020 @07:15PM (#22754567)
The difference is a phone has never been a general purpose computing device. So saying that we need to make them one so that laptops remain one sounds to me akin to “if we don’t have full control of the software our watches run, we might one day end up not having full control of the software our laptops run”. It’s a bizarre comparison to make in my opinion.
Re:Zoom has a signed binary that runs any unsigned script by EvanAnderson on Wednesday April 01, 2020 @07:33PM (#22754672)
I think you have it backwards. A general purpose computing device had never been a phone until recently. Now that it is, why should it have to lose its general purpose computing roots.

I dreamed about having a portable computer, somewhat like what my phone is now, when I was a kid. It ended up even cooler than I imagined it. The eventual device that came along has amazing battery life, oodles of CPU, RAM, and secondary storage, a wide array of sensors, multiple cameras with high resolution sensors and great optics, water resistance, exceptional build quality, a very small form factor, and it's at a price point that's reasonable. It's all great, except that I don't actually own it and can't use it for what I want.

Giving up control of the devices we own is dangerous. It most certainly is a slippery slope. The manufacturers will use "security" and "privacy" as a way to erect walled gardens on our heretofore general purpose computing devices. They will use the walled gardens to extract more revenue from developers and end users, and they'll act as police over what are "acceptable" applications. The average non-technical person doesn't understand why it's a problem, and those of us who are technical should be championing ownership instead of giving up control.

Chromebooks had a physical interlock that enabled/disabled the "trusted" functionality (perhaps they still do-- I haven't followed them). That is an acceptable solution, to me. It wouldn't be difficult to do, either. The fact that manufacturers don't include such functionality speaks volumes about their motivations.

Re:Zoom has a signed binary that runs any unsigned script by ookdatnog on Thursday April 02, 2020 @04:56AM (#22757277)
If it is designed to run arbitrary software, clearly it's a general-purpose computing device, no? And maybe the ergonomics of phones makes their potential as general-purpose computers limited, but that argument doesn't fly for tablets (even on HN people use their tablet as a main work device, eg: https://news.ycombinator.com/item?id=22731192), and iirc Apple's draconic policies also extend to iPads.

It certainly looks like a slippery slope from where I'm standing. People have gotten used to not having full ownership of their phones, and tablets are kinda just big phones, so people have gotten used to not having full ownership of their tablets. But a tablet is also kind of like a small, highly portable laptop, and in fact many people use them as such. The boundary between the two is also blurring, with tablets becoming more laptop-like and laptops becoming more tablet-like.

I don't think it's a huge leap from here to fear that we are witnessing a trend, and that our ownership of our true general-purpose computing devices, such as our laptops, is not something we should take for granted.

Re:Zoom has a signed binary that runs any unsigned script by throwanem on Wednesday April 01, 2020 @09:52AM (#22748450)
My phone isn't a computer; it's an appliance. It needs to be reliable and secure before it needs to be anything else. If being as reliable and secure as possible means it does not compute freely, that's fine by me; that's what I use computers for.
Re:Zoom has a signed binary that runs any unsigned script by userbinator on Wednesday April 01, 2020 @09:50AM (#22748439)
It's the slow rise of authoritarianism. Seeing people essentially say "please enslave us more" is quite disturbing.
Re:Zoom has a signed binary that runs any unsigned script by EvanAnderson on Wednesday April 01, 2020 @11:20AM (#22749575)
Thank you for continuing to be a voice of reason. I'm simply blown away by the apologists for normalizing owner-hostile culture in personal technology.

Manufacturers could include physical interlocks to allow this "trusted" functionality. Early (all?) Chromebooks had this kind of functionality. Manufacturers aren't including it because it locks-in their revenue streams, and owners aren't demanding it because the average non-technical user (and, apparently, technical people too) don't understand the value of the ability to control the devices you own.

Re:Zoom has a signed binary that runs any unsigned script by Chlorus on Wednesday April 01, 2020 @01:03PM (#22750945)
Yes being able to freely buy a product that offers a different point on the security / openness continuum is slavery, and phrasing it like that doesn't undermine either the meanings of the word 'enslave' or 'authoritarianism'. Congrats on your dedication to your cyberpunk larp!
Re:Zoom has a signed binary that runs any unsigned script by Nextgrid on Wednesday April 01, 2020 @07:54AM (#22747753)
Part of Apple's value proposition (to me at least) is that they are (supposed) to keep the bad guys away from the platform and have a huge influence on app developers to force them to comply with their rules.
Re:Zoom has a signed binary that runs any unsigned script by amelius on Wednesday April 01, 2020 @08:03AM (#22747800)
But it provides a false sense of security.
Re:Zoom has a signed binary that runs any unsigned script by valuearb on Wednesday April 01, 2020 @12:45PM (#22750708)
Statistics say otherwise.
Re:Zoom has a signed binary that runs any unsigned script by pubstik on Wednesday April 01, 2020 @02:02PM (#22751672)
And yet, here we are. Again.

Fact is that the 3rd party apple ecosystem just moves more slowly, breaking less, but fixing less too.

Tradeoffs, not superiority, are the choices offered to consumers currently.

Re:Zoom has a signed binary that runs any unsigned script by ajphdiv on Wednesday April 01, 2020 @09:04AM (#22748115)
This software isn't available thru the mac app store. Hopefully, we never get to the point where Apple can decide what I can/can't run on my mac.
Re:Zoom has a signed binary that runs any unsigned script by gregoriol on Wednesday April 01, 2020 @05:54PM (#22753911)
When it's a known malware/security hole/misleading with intent, you'll be happy someone prevents it from running on your mac.