Zoom has a signed binary that runs any unsigned script

Re:Zoom has a signed binary that runs any unsigned script by virgilp on Wednesday April 01, 2020 @01:16PM (#22751107)

Did you even have signed apps (typically) installed in Leopard? Anyway, it depends on the standard of proof. But for the parent comment, it's fairly easy to get most reasonable people to agree that it's false. As a reminder, the claim is about:

> the number of Mac users running 100% signed code

You just have to ask yourself:

- what percent of Mac users run Javascript code

- what percent of Javascript code is signed.

[ Parent | on HN ]

Re:Zoom has a signed binary that runs any unsigned script by Twisell on Wednesday April 01, 2020 @01:55PM (#22751585)

Obviously OP meant outside of sandboxed environment.

There might be exploit out there that exit the sandbox, but they are unintended. But here zoom is intentionaly widening an exploit by being reckless. So thanks to zoom we might now expect even more drastic sandboxing in next MacOS release.

[ Parent | on HN ]

Re:Zoom has a signed binary that runs any unsigned script by virgilp on Wednesday April 01, 2020 @02:18PM (#22751854)

I disagree, not only is it not obvious - it's fairly obvious that he didn't mean that.

> the number of Mac users running 100% signed code is well over 50%

Would you say he meant "number of users running exclusively sandboxed code"? Or do you claim he means "number of users running 100% signed code outside the sandbox"? The only claim that would even make sense is "more than 50% of Mac users run exclusively sandboxed code". And it can't mean "app sandbox", but any kind of sandbox? Like, do java programs qualify? Is the JVM malware? If you install a signed app that requires the JRE, do you also install something that could run unsigned code?

[ Parent | on HN ]