Hacker News Reader

Comment by Wowfunhappy | Hacker News Reader

While I also dislike this type of thing, remember that Zoom's business is built on getting people into calls as quickly as possible. Seconds matter.

So I can totally understand why they would want to use 7zip to shave kilobytes off the download size.

View on HN

7zip isn’t the complaint, it’s that the installer installs the app before the user OKs it.

Honestly zoom is something that I would never let near a personal computer. What really surprised me is that there’s a “zoomgov.” (a friend at a defense contractor showed me) Either our government is enjoying the benefits of being able to force companies to be audited because of defense budgets or things have become way more relaxed than they should be. Judging by our “stockpiles” and inability to get critical equipment I’m guessing the second one.

> 7zip isn’t the complaint, it’s that the installer installs the app before the user OKs it.

...I was about to write a reply saying "well in that case I don't understand what the GP is complaining about", but then I opened up the installer again.

I didn't fully take in what the parent was saying. Zoom is completely short-circuiting the normal macOS package install flow. You click continue once to acknowledge that "this package will run a program to determine if the software can be installed", and then Zoom is suddenly installed and the installer exits.

I can understand why they did it, but it's not good.

Although, Apple deserves some blame here. Firstly because their non-app-store software install flow has been screwed up since the release of Lion, and secondly because why can't you use Installer's "Show Files" option before the preinstall step?

I'm not a MacOS user, but I'm having a really hard time getting my head around this:

1. You download an installer.

2. You activate that installer.

3. Your system tells you that the installer can run some code.

4. You agree to the installer running some code.

5. The installer installs some software, via the code that you said the installer could run.

Seems perfectly acceptable to me. If you literally cannot open up the archive file to inspect its contents without running some code inside it, that's not Zoom's problem. It's just a really stupid decision on the part of Apple.

> Your system tells you that the installer can run some code.

The message reads "this package will run a program _to determine if the software can be installed_". Old iWork updates used this to see you had a previous version of iWork on your computer. nVidia's Web Drivers used it to check if your Mac had an nVidia card. No other macOS pkg that I'm aware of makes actual changes made to your system during this step. That's not what the user agreed to.

Behind the consent message is a grayed-out "next" button that you never get to click.

I suppose this system was ripe for abuse, but that doesn't excuse the people who abuse it.

This is a legacy path in the installer they are abusing.

Pre-install scripts are only supposed to do things like check if you have prerequisites installed, eg if your app requires some version of Python or whatever.

Instead they are abusing that to just install everything immediately.

There is literally no reason for it beyond saving one or two clicks.

Apparently, there's an upgrade for HIPPA compliance, too. I have no idea what that entails or how to tell from the client-side if that's in place. I was working with a medical provider and had to switch to remote sessions. Our first VC was cancelled last minute because they were upgrading the account for HIPPA.

This is a great point. People understand installers/.pkg files far better than `.app`'s wrapped in a DMG. Those often get launched inside the DMG which has a ton of other issues, rather than being dragged to the Application folder.

Also packages allow for easier deployment rather than dmg's.

This isn't the point, it's the fact that the installer is being abused to install an app without even giving the user the option to proceed or not. Nothing should be installed as part of the preflight.

Par for the course with Zoom, so it seems.

I don't think it installs it I think it just calls the resource from the package.

NVM I decided to inspect the package with `pkgutil`

Here's the offending code

```################################### function install_app_to_path(){ #path=$1 InstallPath="$1/.zoomus_"$(date)"" mkdir -p "$InstallPath" mkdir -p "$InstallPath/Frameworks" if [[ $? != 0 ]] ; then rm -rf "$InstallPath" return 1 fi

    if [[ -d "$1/zoom.us.app" ]] ; then
        rm -f "$1/zoom.us.app/Contents/Info.plist"
        mv "$1/zoom.us.app/Contents" "$InstallPath/trash"
    fi

    if [[ $? != 0 ]] ; then
        rm -rf "$InstallPath"
        return 4
    fi

    rm -rf "$1/zoom.us.app"
    if [[ $? != 0 ]] ; then
        rm -rf "$InstallPath"
        return 4
    fi

    mdfind 'kMDItemCFBundleIdentifier == "us.zoom.xos"'> .zoom.us.applist.txt

    echo "["$(date)"]un7z zm.7z =================================" >>"$LOG_PATH"
    if [[ -f res.7z ]] ; then
        ./7zr x -mmt ./res.7z -o"$InstallPath/Frameworks"&
    fi

    if [[ -f resReitna.7z ]] ; then
        ./7zr x -mmt ./resReitna.7z -o"$InstallPath/Frameworks"&
    fi

    if [[ -f bundles.7z ]] ; then
        ./7zr x -mmt ./bundles.7z -o"$InstallPath/Frameworks"&
    fi

    un7zresult=$(./7zr x -mmt ./zm.7z -o"$InstallPath" 2>>"$LOG_PATH")
    ret=$?
    echo "["$(date)"]check un7z return:$ret, $un7zresult">>"$LOG_PATH"
    wait
    echo "["$(date)"]un7z all finished">>"$LOG_PATH"
    if [[ $ret != 0 ]] ; then
        rm -rf "$InstallPath"
        return 3
    fi

    mv "$InstallPath/Frameworks/"* "$InstallPath/zoom.us.app/Contents/Frameworks">>"$LOG_PATH"
    mv "$InstallPath/zoom.us.app" "$1" >>"$LOG_PATH"
    if [[ $? != 0 ]] ; then
        rm -rf "$InstallPath"
        return 1
    fi

    if [[ "$APP_PATH" == "$GLOBAL_APP_PATH" ]] ; then
        chmod -R 775 "$APP_PATH"
        chown -R :admin "$APP_PATH"
    fi

    echo "["$(date)"]mv $InstallPath/zoom.us.app into $1">>"$LOG_PATH"

    rm -rf "$InstallPath"&
    return 0

}```

This is just horrendous.

ugly? Most definitely, offensive? Not really.

Among other things, it offends me that this runs in a preinstall script.

> Seconds matter.

Whenever I have been told that I have a meeting coming up with some kind of conferencing software that I don't have installed, I immediately install it. I don't wait until 3 minutes before the call to try and install. All kinds of things could happen, such as incompatibilities or missing passcodes.

Reply on news.ycombinator.com