Hacker News Reader

Comment by diafygi | Hacker News Reader

I'm confused. Does the patch now make it to where if you drag the app to the trash, it actually uninstalls?

A macOS "app" is just a directory with an executable binary and some convenient helper files for Finder. Dragging it to the trash does not remove artifacts, such as logs, supporting binaries, even methods of persistence, which may get placed somewhere else on the filesystem as part of a typical installation. This is not unique to Zoom or even Apple operating systems.

One thing I'd like to see (and this is definitely doable on macOS side) is that if you trash a .app, the OS would automatically revoke all permissions to it.

If this were done then even with the sneaky reinstalling, the user would be alerted by a system dialog requesting access to their webcam.

If you have a ktext kernel driver to implement generic access to video input subsystems (think v4l) then why exactly would the user be alerted if the developer didn’t add the feature?

Read: anyone can write a kernel driver for macOS, you are too trusting of your software vendors. Get a hardware switch

> anyone can write a kernel driver for macOS

No they can't. With SIP you won't be able to install it if it is not signed (for kernel extensions only a very few developers have certificates) and in any case you will be alerted about it. Also there are plans to completely disallow making kernel extensions in release after Catalina (since they can now run in userspace, I imagine that userspace will not get access to pre-installed hardware)

However, if you're going to automatically install a daemon, you can and should make that daemon check whether the originating app still exists, and automatically uninstall itself if not.

(Better still, reconsider whether you really need a daemon in the first place...)

According to one of the updates in their response blog post (https://blog.zoom.us/wordpress/2019/07/08/response-to-video-...), you need to choose it through the Zoom menu bar:

> We’re adding a new option to the Zoom menu bar that will allow users to manually and completely uninstall the Zoom client, including the local web server. Once the patch is deployed, a new menu option will appear that says, “Uninstall Zoom.” By clicking that button, Zoom will be completely removed from the user’s device along with the user’s saved settings.

First, does the patch actually fixes it? In original report, they "patched" it with the flaw remaining.

Reply on news.ycombinator.com