Zoom Updates Mac App Installer to Remove Controversial 'Preflight' Installation Method

[MacRumors]

The popular video conferencing company Zoom has been under scrutiny over the past few days for the method used to install the Mac version of its app, which essentially abused a "preflight" compatibility check to install the app without the user needing to explicitly grant installation permission, as highlighted by developer Felix Seele earlier this week.

Screenshot of preflight compatibility check for Zoom; clicking Continue immediately installs the app if the user has admin privileges (via Felix Seele)​

Zoom CEO Eric Yuan responded to Seele, noting that while the installation method was "implemented to balance the number of clicks given the limitations of the standard technology," he recognized the issue and promised to "continue to improve."

Revised installer with traditional installation process​

Zoom has now updated its Mac app installer to no longer use the preflight installation method, instead using a traditional installation authorization process, as noted by The Verge.

"They completely removed the preinstall stuff, so you now need to click through the installer as it ought to be," explains Seele in a message to The Verge. The fake prompt has also been removed so users have to specifically click through and install Zoom. "I must say that I am impressed," says Seele. "I expected them to maybe change the dialog, but since the 'zero-click' aspect was so important to them, I thought they would stick with the preinstall-trick."

The Mac app installation issue is hardly Zoom's first controversy, with the company seeing increased attention as its popularity has boomed amid self-isolation. Other recent controversies over just the past week have included its integration with a Facebook SDK that was sending Zoom user data to Facebook and misleading claims of end-to-end encryption.

Article Link: Zoom Updates Mac App Installer to Remove Controversial 'Preflight' Installation Method

 

[Emanuel Rodriguez]

Zoom's whole way of doing things is to make everything as simple as humanly possible, which is the reason they're so popular right now.

Seriously, it's the only piece of software I can think of that I've had next to no support requests for. It's unbelievably simple to use. I don't really see the problem with this. Minimizing clicks should be more important to all devs.

 

[madmin]

Always too little too late with Zoom

 

[motm95]

It seems like they made some bad choices, but it also seems like they are recognizing the fact they were bad choices and are quickly taking steps to address them.

It's easy to fault them but perhaps such quick acknowledgement and rapid changes are a good sign.

 

[madmin]

It seems like they made some bad choices, but it also seems like they are recognizing the fact they were bad choices and are quickly taking steps to address them.

It's easy to fault them but perhaps such quick acknowledgement and rapid changes are a good sign.

Let me know when they stop making bazillions auctioning users behavioural surplus on the data markets

 

[longofest]

Remember when they installed a web server on macs without anyone knowing that resulted in a zero day?

Not a fan of Zoom since then. Nothing they have done since then has endeared me any more. I prefer FaceTime, Skype, or pretty much any other method to connect than Zoom.

 

[sakagura]

Zoom's whole way of doing things is to make everything as simple as humanly possible, which is the reason they're so popular right now.

Seriously, it's the only piece of software I can think of that I've had next to no support requests for. It's unbelievably simple to use. I don't really see the problem with this. Minimizing clicks should be more important to all devs.

Yeah? Let's do an experiment. Get 20 people in a chat together saying pro democracy, pro Hong Kong and pro Taiwan stuff and see how long your privacy and connections last.

 

[From Win to Mac]

Smart, unfortunately. They already exploded in popularity because they were soooo simple to install and use. Now their momentum is gonna carry them through.

 

[motm95]

Remember when they installed a web server on macs without anyone knowing that resulted in a zero day?

Not a fan of Zoom since then. Nothing they have done since then has endeared me any more. I prefer FaceTime, Skype, or pretty much any other method to connect than Zoom.

Wow, I didn't know about that one. Yikes.

Okay, maybe they haven't learned a damn thing.

 

[From Win to Mac]

Yeah? Let's do an experiment. Get 20 people in a chat together saying pro democracy, pro Hong Kong and pro Taiwan stuff and see how long your privacy and connections last.

It won't be any different than before. If you do it anywhere in China, on any social tool, you're toast. If you do it anywhere but China, on any social tool, like everyone already does, you're fine. There's plenty of horrific racism and more worldwide on Tik Tok, but of course none of that would be permissible if it was posted from within China.

 

[jarman92]

Remember when they installed a web server on macs without anyone knowing that resulted in a zero day?

Not a fan of Zoom since then. Nothing they have done since then has endeared me any more. I prefer FaceTime, Skype, or pretty much any other method to connect than Zoom.

Yeah and their justification for that was also "less clicks." Are clicks hard? I must be missing something...

 

[MichaelQ]

Would have thought the bigger issue is not that they did this, but that they CAN do it?

Surely this is a bit of a security issue that Apple needs to fix?

 

[konqerror]

Zoom's whole way of doing things is to make everything as simple as humanly possible, which is the reason they're so popular right now.

Seriously, it's the only piece of software I can think of that I've had next to no support requests for. It's unbelievably simple to use. I don't really see the problem with this. Minimizing clicks should be more important to all devs.

Then they should implement drag-to-install, just like competitors Skype and MS Teams do.

They also have the option of a custom installer, like Bluejeans and Webex. Instead, they chose to save clicks by abusing an API.

 

[DinkThifferent]

Do I need to delete and reinstall Zoom for more security after this change?

 

[madmin]

Do I need to delete and reinstall Zoom for more security after this change?

No, you only need to do the first step

 

[brand]

No, you only need to do the first step

I see what you did there, nice.
[automerge]1585856581[/automerge]
It's worth mentioning that RingCentral also uses Zoom backend. Since RingCentral writes their own front end this should not be an issue for them.

 

[Nuno Lopes]

Along the way zoom has had many practices that are fishy. They only retire when caught. If there was nothing wrong why retire? Stick to it.

Looks guilty.

 

[kiensoy]

Remember when they installed a web server on macs without anyone knowing that resulted in a zero day?

Not a fan of Zoom since then. Nothing they have done since then has endeared me any more. I prefer FaceTime, Skype, or pretty much any other method to connect than Zoom.

Remember when a person could hear you before you picked up a FaceTime call? Bugs happen.

 

[konqerror]

Remember when a person could hear you before you picked up a FaceTime call? Bugs happen.

A software bug is one thing, engineering a buggy web server to intentionally bypass a browser security measure, engineering an installer to get around user confirmation prompts, and being deceptive in your advertising and documentation are on a totally different level.

 

[Azzin]

I also despise that they claim to use end to end encryption, when in fact, they don’t.

 

[greenbreadmmm]

sketchy news, after sketchy news, after sketchy news.

Let's call a spade a spade, they are nefarious in nature.

 

[talmy]

Security issues aside, yesterday I installed and used Zoom to attend a "webinar" with 170 attendees. Almost all of whom, like me, are Boomers or older, and probably using it for the first time. Software ran smoothly with great video/audio quality and responsiveness. Lost less than 5 minutes due to user screwups. I was impressed. I've used GoToMeeting before, and regularly use Skype on 1-to-1's and Zoom is far and away better..

 

[Emanuel Rodriguez]

Yeah? Let's do an experiment. Get 20 people in a chat together saying pro democracy, pro Hong Kong and pro Taiwan stuff and see how long your privacy and connections last.

I don't think you understand what an installer is.
[automerge]1585861657[/automerge]

Security issues aside, yesterday I installed and used Zoom to attend a "webinar" with 170 attendees. Almost all of whom, like me, are Boomers or older, and probably using it for the first time. Software ran smoothly with great video/audio quality and responsiveness. Lost less than 5 minutes due to user screwups. I was impressed. I've used GoToMeeting before, and regularly use Skype on 1-to-1's and Zoom is far and away better..

Exactly. It's an excellent product. People are just being overly negative.

I do agree that they have some issues to work out, but that's fine. I'm sure it'll all be resolved with time, and we can go back to yelling at each other on Twitter.

 

[DeepIn2U]

Zoom's whole way of doing things is to make everything as simple as humanly possible, which is the reason they're so popular right now.

Seriously, it's the only piece of software I can think of that I've had next to no support requests for. It's unbelievably simple to use. I don't really see the problem with this. Minimizing clicks should be more important to all devs.

COVID-19 and availability for use is what made them super popular (alo NC with minimal signup steps). Yet their practices have come into light lately andbig adjustments for the better has been quickly implemented.

 

[Emanuel Rodriguez]

COVID-19 and availability for use is what made them super popular (alo NC with minimal signup steps). Yet their practices have come into light lately andbig adjustments for the better has been quickly implemented.

For sure. If you know software development, you know that any development firm which goes as far as they do to make things easy to use for their customers (not at all easy for the devs), actually does care about them, in much the same way Apple does. The fast fixes are a sign of that as well.