Google Makes You Think You're Smarter Than You Actually Are - <AUTHOR> http://www.huffingtonpost.com/2015/04/01/google-psychology_n_6984348.html

<comment><USER2> Google also makes you _actually smarter_ than you actually are, at least when used right...

<comment><AUTHOR> The title is link-baity (but matches the article). Perhaps it would have been more helpful to link to the actual research:

[http://www.apa.org/pubs/journals/releases/xge-0000070.pdf](http://www.apa.org/pubs/journals/releases/xge-0000070.pdf)

with the better (though I think still not quite getting the point) title _Searching for Explanations: How the Internet Inflates Estimates of Internal Knowledge_.</comment></comment>


Ask HN: About SICP book - <AUTHOR>

I don't know where to post this kind of question, but since SICP (Structure and Interpretation of Computer Programs) is a computer science related book, I though maybe here I would get an answer. So, I want to buy the book and Amazon says it has 683 pages. A paperback version would be ok? I mean, in terms of paper quality. I bought recently the book "JavaScript The Definitive Guide" (more than 1000 pages) and the paperback version sucks.
Anyone has the Amazon paperback version of SICP?<p>(The hardcover is a little expensive for me). (I know that I can read the online version for free, but I want the physical book). <comment><USER2> I have the paperback. It's just fine. If you're happy with an ebook, it's available for free.

</comment><comment><USER3> Pro tip. Install emacs. Install sicp from melpa. Profit.

</comment><comment><USER4> The paperback is just fine.</comment>


How Japanese Americans Built a 'Useful American Life' in 1940s Chicago - <AUTHOR> https://www.zocalopublicsquare.org/2020/06/03/japanese-americans-world-war-ii-manzanar-incarceration-wartime-prisons-relocation-chicago-community/ideas/essay/ <comment><USER2> And they are still discriminated against at elite American universities where despite awesome grades, test scores, and extra curricular activities, the universities somehow find them lacking in "personality".

<comment><USER3> No, the problem is artificially adjusting admission criteria based on the race of the applicants to achieve "correct" race distribution on the campus.

<comment><USER4> The core question is: what should a "correct" ethnical distribution be on campus?

Should it roughly match the composition of the general population?

Should it be biased towards ethnicities historically suppressed?

Should it be totally independent of ethnicity and only focus on highschool exam results?

In the end this is a political question. The naive answer would be option #3 which has the downside though that it does not account for _prior_ discrimination in primary/secondary schools that all too often favor students of white middle-class parents due to a combination of factors, so the modern approach is more or less option #2.

<comment><USER3> It's funny to call it naive approach when it works perfectly well in many European countries. The so called "modern" approach doesn't even favour disadvantaged students, it simply favours children of well-off favoured minorities parents. And in addition it creates animosity because of favouritism and makes other students think that the students from group with lower entrance requirements are less capable even if those particular students would be able to enter on their own merits.

If there is any discrimination in primary/secondary education, it should be fixed instead of trying to engineer society by introducing "good" racism (which actually hurts Asian minorities).

<comment><USER5> I'm an Asian living living in northern Europe. I never have to mention my race on any kind of form. A lot of things in the US baffles me.</comment></comment></comment></comment></comment>


Ask HN: What to do with counterfeit hardware? - <AUTHOR> I ordered brand new Corsair RAM from Amazon itself (not some reseller) and received something that look like the Corsair DDR3L 2133 sticks I ordered before, with the same label, but that shows SPD information identifying them differently. The label says 2133 however.
I fear it is likely to be some kind of counterfeit item - maybe someone is just counterfeiting label and boxes to defraud unsuspecting buyers, who may not have other sticks to compare.
I tried calling amazon, they said to just return it. I asked my call to be escalated, they didn't seem to care much. Returning it for a refund won't help solve the problem: there are counterfeit items that somehow end up on legitimate resellers site.
I would never have caught that if I had not run a memtest and checked the SPD information.
So I ask HN: what should I do? Who cares about counterfeit hardware, except the client? (there is some serious price difference between DDR3L 2133 and 1600) <comment><USER2> Corsair might care, and you can of course post a review to at least help warn other users.

</comment><comment><USER3> detaro is correct.

The manufacturer and the authorized reseller are the only entities with skin in the game. The manufacturer has cause to protect their brand, and the authorized reseller probably prefers to remain authorized.

Because only the manufacturer has the leverage to make authorized resellers pull counterfeit stock, going straight to the manufacturer seems the best solution. Hell, maybe you'll even get a freebie for reporting the problem.

<comment><AUTHOR> Thanks, I just send an email to warn Corsair.

It's not just about cost, but the time spend. I wasted a few hours until I noticed the issue. And now I am wary of purchasing again from Corsair or Amazon.

And I feel slightly disgusted by all this :-(

<comment><USER3> I commiserate. Unfortunately, this is a daily struggle for some, particularly in networking.

The world's largest vendor of network appliances, Cisco, has the worst problem with unauthorized equipment I've ever seen. Even the US federal government, probably Cisco's largest customer, is constantly assailed by unathorized gear from authorized resellers. I'm even aware of companies factoring in project lead time for handling licensing problems for this reason.

Still, this is just one example, and I'm certain many manufacturers have this problem, though it surely varies proportional to the price of the good. Regardless, caveat emptor, and know the provenance of what you purchase.

Best of luck.</comment></comment></comment>


Ask HN:hey developers, what brings you joy? - <AUTHOR>

Hey Guys<p>Just wondering what makes you happy ? Well written code, beautiful designs and appreciation to my work brings me joy. What about you ? <comment><USER2> Shipping the product. I'm your average developer, work in a small software shop, not a startup, not a fortune 500 company. Getting the thing out of my hands, and into the hands of our customers makes me happy.

For my own personal projects: having users use it. I started with android apps last year, very slowly (too slowly), but having someone use the app brings joy to me. My first project, which was a website in about 2003, got me into a slump after there were only a couple of people who even tried it (should have marketed it, thinking about it now). However I still use it - so it's not a total waste.

I am actually afraid of writing beautiful code, as when that was my goal, each of those projects have either been canceled (at work), or never made it past recoding stage (at home).

Another thing that brings me joy is solving a complicated client issue. Normally our support solves all the issues, however when we did first large scale installations, I was sent to customer site to diagnose a large list of problems. It feels good to make issues go away.

</comment><comment><USER3> As a developer, I feel joy with following:

-My code _finally_ compiles/runs without errors after a long battle with a bug/issue.

\- Reading through my code after a few days and realizing I did _something_ no matter how small.

\- Refactoring a really messy/sphagetti code and getting it to work the first time

</comment><comment><USER4> Finding a solution to a problem that I've been hung up on, especially if it's one of those "well, can't search google for a solution to THIS". When the solution comes as a surprise. Spend three hours trying to figure something out, then go to the grocery store and have that "AHA! I got it" moment.

</comment><comment><USER5> Deleting code: leaving behind simplicity, and bringing order where there was chaos.

<comment><USER6> The world needs more deleters of code!

</comment></comment><comment><USER7> One of my favorite parts of developing is seeing my code get used. I suspect it's a bit like the pleasure a chef has when he watches someone enjoy his cooking.

</comment><comment><USER8> Making progress. Looking through my old code shows me just how much I've improved :)

</comment><comment><AUTHOR> Infact hacking new things , customizing product as per my needs brings me joy.

</comment><comment><USER9> Writing 100+ lines of code and having them work on the first run.

</comment><comment><USER6> Working with and learning from people who are smarter than I.

</comment><comment><USER10> Beer</comment>


Psychologists Release Emotion-On-Demand Plug In For Virtual Characters - <AUTHOR> http://www.technologyreview.com/view/507786/psychologists-release-emotion-on-demand-plug-in-for-virtual-characters/ <comment><USER2> This could have some interesting implications when it comes to emotion response testing.</comment>


John Carmack on Python Processing - <AUTHOR> https://twitter.com/ID_AA_Carmack/status/1250579754132135937 <comment><USER2> I love that people try to tell Carmack the most obvious things, like he doesn't know them. It's like watching The Office, such a cringe-fest.</comment>


The Bermuda Triangle of Productivity - <AUTHOR> http://phewsha.tumblr.com/post/2084775636/the-bermuda-triangle-of-productivity-where-does

<comment><USER2> HN is missing from this triangle

<comment><USER3> For me it's HN, Reddit, and Gmail.

<comment><USER4> For me, it's HN, Metafilter, and HN again just in case.

</comment></comment></comment><comment><USER5> Are you talking about Rich that works two cubes from me? Wait, you're not!

I don't see many people tweeting from work, but I do see some Facebook abuse. I don't consider gmail being to unproductive unless a person is running a side business at work through Gmail. That shouldn't fly.

</comment><comment><USER6> ACCESS DENIED. Lol.

I guess I don't have a problem with that triangle. I do find it funny that out of so many blocked sites at my workplace, Reddit is not... must be Redditors in ITD.

</comment><comment><USER7> BlockSite 0.7.1.1

A browser plugin that blocks websites you don't want to visit ever again. (You can put them behind a password making it a nuisance to turn it off)</comment>


Help me name my new gaming company  - <AUTHOR> Hey! I am also looking for a suitable name for the new company. Help me pick the best!
Candidates:
Ticbit
Any Key to Play
Do While Play
Gravity Fun
Gameonium
Gaming Byte
Mad Council
Mouse Aim
You have five points to spend in your votes, spend them any way you like (ie. one name gets 5 pts, or 3+1+1 etc..)
Thanks to anyone who votes! <comment><USER2> Can we nominate? I put 5 points on 'Brian.' It's kid-friendly, and after people laugh at it they'll remember it because it's an unusual name for a company. It's very personal.

I think about names a lot. I'm too tired now to dig up my old posts about it, but what your existing pool all have in common is that they're trying to describe what sort of company you are. This is not what a name is for - a few companies do have such names, but they tend to be first-in-market ones like Electronic Arts. What you want from a name is stickiness. It doesn't have to explain anything: it has to provoke people's curiosity.

I was one of the few nerdy people to get the pun in 'Google.' But that didn't matter - the first time people heard the word, there was no way they could forget it. From your short list of aspirational names, I feel like your company should be called Brian.

      'What's the name of your company?'
      'Brian.'

Nobody, but nobody, is going to let the conversation end there. They will ask you more questions, and the will tell people about a funny little company called - get this - 'Brian.'

<comment><AUTHOR> Yep feel free to nominate.

I do like Brian, but personal names are, well, personal and I have no relation to anyone called Brian. I do not even have any superhero character I like that is called Brian. Interesting view though.

<comment><USER2> I forgot to mention that it's an anagram of 'brain.' See how it goes for you _ I realize it's from far out of left field.

</comment></comment></comment><comment><USER3> My first reactions:

        Ticbit           tidbit?
        Any Key to Play  too long
        Do While Play    too long but edible
        Gravity Fun      bland
        Gameonium        game onion?
        Gaming Byte      auto generated?
        Mad Council      now that's a name
        Mouse Aim        FPS-only?

I'd follow kellros' advice: go for a short, solid name.

<comment><AUTHOR> Great feedback. Mad Council is very popular choice, but since our first game is for kids I am wondering what can be effect of "by Mad Council" as the first thing popping out when you start the game for you child.

</comment></comment><comment><USER4> Hah, when I saw your question and Tidbit popped into my head - quite amusing to see you got ticbit as your first option :).

I'd almost not go for an adjective. Think about names of popular companies such as 'Blizzard', 'Electronic Arts', 'Zenga' etc. You could call it 'Storm' or 'Zero' - the real trick is just to get a name that hasn't been taken yet.

Good luck.

<comment><AUTHOR> Thanks, so Ticbit 5 pts from you :) How about Gameonium?

</comment></comment><comment><USER5> From the list I like best "Mouse Aim", the others are kinda ordinary, the second would be ticbit</comment>


Google.cn DNS routing changed? - <AUTHOR> http://www.the-eleven.com/~tjlegg/index.php?/archives/2865-Google.cn-Moved-Back.html

<comment><AUTHOR> Anyone know how recent this is?

His original post on this topic from 2006 is at [http://www.the- eleven.com/~tjlegg/index.php?/archives/1940-G...](http://www.the- eleven.com/~tjlegg/index.php?/archives/1940-Google-v-Google.CN.html)</comment>


Happy Guys Finish Last: The Impact of Emotion Expressions on Sexual Attraction - <AUTHOR> http://www.publicaffairs.ubc.ca/wp-content/uploads/2011/05/Happy-Guys...in-pres-Emotion.pdf <comment><USER2> OkCupid had already figured this out back in Jan 2010 [1]:

> _For women, a smile isn't strictly better: she actually gets the most > messages by flirting directly into the camera_

> _Men's photos are most effective when they look away from the camera and_ > don't _smile_. _Maybe women want a little mystery. What is he looking at? > Slashdot? Or Engadget?_

> _We were sure [MySpace angle] pictures were lame. But we were so wrong. In > terms of getting new messages, the MySpace shot is the single most effective > photo type for women._

[1] [http://blog.okcupid.com/index.php/the-4-big-myths-of- profile...](http://blog.okcupid.com/index.php/the-4-big-myths-of-profile- pictures/)

<comment><USER3> I always thought OkCupid's blog posts were very fun/interesting. I think they first one I read was about how quality of the picture matters (e.g. phone picture vs SLR...lighting...etc.)

I was disappointed to see just now that the latest entry is from April 2011 :\

<comment><USER4> They stopped then because that's when they got bought by match.com :/ They had lots of fun demographical stuff on there too.

[http://en.wikipedia.org/wiki/OkCupid#History](http://en.wikipedia.org/wiki/OkCupid#History)

<comment><USER5> I worked on the OkTrends team at OkCupid during the year before the acquisition, and I can assure you that that timing is definitely a coincidence.

The posts took a _lot_ of work to create. When I was there, there were two and a half people working full-time[0] just on OkTrends (two engineers full time, and one founder part-time).

I can't give an average time per post, but to give you an idea, "The Real Stuff White People Like"[1] was predominantly my work[2], and it took almost two months, from start to finish.

If you're wondering why it took so long to create that, remember that we started each blog post as a blank slate - at most, we had a vague question that we wanted to explore, and it took several iteration for us to hit upon anything closely resembling the analysis that you'd end up seeing in one of the OkTrends reports.

It might be easy to create something if you have a specific destination in mind at the start, but the key to making OkTrends posts work was _not_ having a specific result in mind - instead, letting the journey guide the process.

Anyway, I left to go back to school, and around that time, the other engineer on the data team started having to do more internal data work on top of the OkTrends research (he stayed at OkCupid for over a year after I left, but he's since moved on as well). That's what caused the slowdown in the posts during late 2010 to early 2011, not the sale to Match.com. As noted below, Christian is working on other projects as well, which have unfortunately left little time for OkTrends.

It's very unfortunate that the timing makes it look like Match.com put the kibosh on OkTrends, because that's not at all what happened, though I definitely see why people would make that mistake.

[0] By "half", I mean that we two engineers spent close to all of our time working on the data/stats, and the founder spent about half his time working with us on the projects and writing the posts.

[1] [http://blog.okcupid.com/index.php/the-real-stuff-white- peopl...](http://blog.okcupid.com/index.php/the-real-stuff-white-people-like/)

[2] I did the stats/munging/research - none of the writing. Christian is a much funnier writer than I am.

<comment><USER4> Definitely good to know. It certainly looked the other way from an external viewpoint given the really close timing. That being said, I'd love it if they'd start up again it was always fascinating from a sociological perspective at what was working for people and what wasn't (It never helped me though, I ended up meeting my SO over IRC instead...)

<comment><USER5> > I ended up meeting my SO over IRC

You're not the first person to tell me that! A friend of mine met his husband on #gaynyc. I still love OkCupid, but I always idle in that chan now, just in case.... :)

</comment></comment></comment></comment></comment></comment><comment><USER6> the controls are terrible. her hair isn't arranged the same in every pic and her breasts are more visible in the happy and pride pics than the neutral one.

all the pics are way too over-acted, the "pride" girl pic isn't a typical girl pose (it's super exaggerated for a guy, and even less realistic for a girl). these poses have little to do with real life. it's just ivory tower BS, incompetently done (quite apart from being so unrealistic, the bad controls are just incompetent even within the narrow field, just by basic scientific standards)

<comment><USER7> Plus, the guy looks down right creepy in the happy picture and he is showing off his muscles in the pride picture. Their shame poses are idiotic. They would have gotten much better results by cropping faces only.

</comment></comment><comment><USER8> I'm confused as to why this post is suddenly at the top of HN, it isn't a new article nor does it present a new idea. There are countless of studies that show that women are more attracted to men who seem mysterious/proud/narcissist/dangerous/the opposite of your minivan-driving soccer dad. Does this imply that the HN community is generally unaware of the difference in the male-female sexual preferences and thus finds this article mesmerizing? Is there nothing else as worthy of the front page? Am I just being cynical?

Here's a post from Heartiste (at the risk of losing my credibility) that talks about the subject.

[http://heartiste.wordpress.com/2013/04/26/why-are-men- with-d...](http://heartiste.wordpress.com/2013/04/26/why-are-men-with-dark- triad-personalities-so-irresistible-to-women/)

</comment><comment><USER9> This is highly anecdotal, but when I was younger (from ~5-15 years ago), I noticed I was far more likely to have people start fights* with me when I was in a good mood and enjoying myself. Yet this never seemed to happen when I walked around with a bit of an angry look in my eye, like I had been having a bad day and was just waiting for someone to start something. I even informally experimented with it, sometimes approaching people in a cheerful, happy way, and other times approaching them like I was in a really bad mood. Men seemed to treat me much better when I was faux-pissed, and much worse when I was in a good mood. The authors didn't experiment with this (that I could tell), but I'd hypothesize that males have the same reaction towards happy expressions in other males - they don't like them and it initiates aggressive tendencies.

*You might ask why I was getting into fights in the first place, and all I can say is that high school and college are rough and most of the population doesn't seem to be as sophisticated as the typical HN reader.

<comment><USER10> This always puzzled me.. when I have a great day, and walk around with a puffed chest smiling at people, women positively seem to ignore me. When have a bad day, or didn't wash my hair or something, it's the opposite, and I get eyed when I don't really want it. Once I walked around sulking, more or less staring at the ground, and a random young woman told me I was "very beautiful". I said thanks, but thought "WTF?! I look like shit."

Maybe people like it when they feel like they have to offer something to a person.

</comment></comment><comment><USER6> what is this crap and why is it upvoted?

> In contrast, women over the age of 30 tended to rate shame- and happy- > displaying men as equally attractive (and both more so than neutral).

happy guys finish ahead of control, not last... and the BS title is from the original paper.

that's over 30, but several of the graphs in the paper (not all) show happy guys beating the control. meanwhile i don't see anything clearly indicating happy guys lost to the control overall; it looks more the other way around. at the very least, it's not clear happy guys finish last and lose to the control.

EDIT: the abstract says:

> happiness was the most attractive female emotion expression, and one of the > least attractive in males.

so they knew the title was BS and didn't repeat the claim in the abstract. in the abstract they use weasel words, in the title they intentionally lie to get more attention/views.

</comment><comment><USER6> There are a variety of alternative explanations, consistent with the data. The conclusion in the title is just one of many possibilities they didn't differentiate between.

It could be, for example, that guy photos do best when they stand out instead of looking like every other guy. it could be that the best guy photo would be a happy smiling guy who stands out in a different way, but when you remove everything else from the photo and the choices are standing out or being happy, both good, then standing out is better.

this is a standard practice in pseudo "science" – get some data, make up a conclusion that doesn't contradict the data, say you have evidence for your conclusion (or say something stronger), don't carefully think about everything else you could have included instead and how to pick between them.

as usual with bad "science", there is no section titled "sources of error" or similar. nor is there a section covering alternative conclusions compatible with the data. if you aren't thinking about all the ways you could be wrong, it's not really science. (and if you think about them but don't publish that part, you're not publishing science)

</comment><comment><USER11> What is with all the use of line graphs for showing categorical vs continuous data? Did the authors not know about bar graphs? It looks absurd and ridiculous.

<comment><USER12> Intuitively agreed at first. But then I imagined the main alternative of clustered columns/bars and now tend to think that line graphs can be grasped more quickly.

Any other alternative graph formats? Maybe just show the deviations from the neutral control?

</comment></comment><comment><USER13> Interesting idea.

I'm curious as to how accurately sexual attraction can be measured by looking at a picture of a person. I don't have a better proposal, barring actually filling a resort with cameras, inviting a bunch of single people to it, and tracking what happens. You could send in some actors who do shame, pride, etc and see how they do, but you'd need to control for their relative physical attractiveness. So I guess you do lots of groups, and the actors change their role every time. Or get identical twins. You'd have to be careful with ethics, though.

</comment><comment><USER14> More scientifically: happy faces are more attractive. [http://www.tandfonline.com/doi/abs/10.1080/02699931.2013.817...](http://www.tandfonline.com/doi/abs/10.1080/02699931.2013.817383) Note the study I reference only used faces, and used the same facial images, digitally altering them to alter the facial expressions. As opposed to Happy Guys Finish Last, which used different photos and included the upper body in the shots.

</comment><comment><USER15> "Participants and procedure. In this study, 184 Canadian undergraduates (50% female; age 17–49 years, median 21; 52% Asian, 48% Caucasian)..."

It would be unwise to draw any conclusions from this study since it was preformed on such a non-random, non-representative slice of the general population.

</comment><comment><USER16> Seems like this research could benefit from a complementary studies and shouldn't stand on one test alone.

</comment><comment><USER17> The photos used in this test are terribly inconsistent.

Each photo has different lighting and distance from the camera.

The happy smile are those artificial smiles that people make when they are posing. A genuine sincere smile may rate completely differently. The person raises their arms for the pride photo, and the posture and visible biceps in this photo may completely distort the perceived attractiveness.

</comment><comment><USER18> Reis et al. (1990): American college students attributed smiling persons greater sincerity, sociability, and competence but _less independence and masculinity_.

</comment><comment><USER19> Is 52% Asian, 48% Caucasian a typical Canadian college student ethnicity distribution?

<comment><USER20> I really can't understand why they didn't take into account the cultural bias tided to the different races. I would guess that Asian people are looking for different values in their partners than Caucasians. And even if I were wrong, I don't think that they should dismiss that proposition without even checking, or citing a relevant paper on the subject.

</comment></comment><comment><USER21> A photo is a tiny, next to non-existing, subset of sexual attraction. Unless all you need is sexting ;)

</comment><comment><USER22> > t(45) = 3.44, d = 1.02, p = .01

I know this is probably extremely simple statistics, but what are these terms?

<comment><USER23> > t(45) = 3.44, d = 1.02, p = .01

I know this is probably extremely simple statistics, but what are these terms?

They're metrics about the strength of the finding - depending on the statistical method you're using, you'll get different ones. They're using ANOVA (analysis of variance) here, which basically compares likelihood mean result of two cohorts is the same.

T(45) gives the t score, which is a measure of deviations from the mean, so 3.5 higher than you'd expect if the populations were the same.

p values is probability it occurred by chance(given equal populations), so 1% in this case, which is pretty strong.

I'm not positive on d, but I think it's a measure of variance within the groups.

Disclaimer: was an Econ major in college but haven't used anova in a long time, I am not a statistician, this is not statistical advice.

[http://en.m.wikipedia.org/wiki/Analysis_of_variance](http://en.m.wikipedia.org/wiki/Analysis_of_variance)

</comment></comment><comment><USER24> Another win for xkcd

[http://xkcd.com/374/](http://xkcd.com/374/)</comment>


How the Zoom macOS installer does its job without you clicking 'install' - <AUTHOR> https://twitter.com/c1truz_/status/1244737672930824193 <comment><USER3> I installed Zoom on macOS yesterday and I thought that the install was crashing because this is not the expected behavior. I would double click the download, try to install, and then the installation program would "crash", so I'd try it again. Did that a few times before I realized it was installed. Until now I thought it had somehow gotten far enough in the installation process before crashing that I could at least use the application. I'd been hearing everyone raving about how Zoom was such better software than anything else, and my first experience was their installer doesn't even work.

This was a horrible user experience for me, and I wasn't thinking about security implications at all.

<comment><USER4> I too don't get how Zoom is considered "the superior software". Maybe the calls don't drop, but the experience is bad (at least on macOS).

<comment><USER5> Said this on Reddit the other day and got downvoted.

It _is_ bad on macOS. It used to be one of the better platforms to stream video content to others, but now it just lacks in many areas compared to most of its competitors.

The worst bug I had was it essentially started muting random people on a call, but only for me. I could see their mouth moving, and thought it was a problem their side but turns out everyone else could hear them apart from me. I could hear everyone else too apart from them.

</comment></comment></comment><comment><USER6> Zoom's got a tradition of being, let's put it like this, way too clever for everyone's own good.

See previous "lets install a server on this Mac that is not removed when you uninstall the app and leaves your camera open to the entire internet" for more examples.

I use it on a VM, I suggest you do it too.

<comment><USER7> Best zoom alternative?

<comment><USER8> Jitsi, Google Meet, bigbluebutton -- anything can runs in a browser tab and is more or less confined within it.

<comment><USER9> I wouldn't be surprised if Zoom suddenly started exploiting browser zero days to force install things "for your own good"

<comment><USER10> Good thing that this is somewhat difficult to do ;)

</comment></comment></comment></comment></comment><comment><USER11> 1) If Zoom can do this then it's a MacOS security bug.

2) UX matters. Users don't care about the technical details, they want a smooth experience and that can be the difference between a billion-dollar business or a failed startup. And yes the desktop version is more stable than the web-based UI.

3) Malware is defined by what it does, not how it's installed.

<comment><USER12> I mean, it's not really a security bug. Installer.app displays a dialog box that says "Hey, this package wants to run arbitrary code to check if it's compatible with your system. Is that OK?" The user is explicitly opting into the code execution. Zoom's "compatibility check" installs the app and kills the installer window. That's certainly unexpected behavior, but I don't think it's an exploit in any real sense.

While normally I'd object to running arbitrary code with just an easily- skippable dialog as confirmation, but I think it's OK in this case where the expectation was that we're installing their software anyway.

<comment><USER13> It's really Apple's fault. "This package will run a program to determine if the software can be installed." Is just fundamentally a very strange statement to make, loaded with vagueness.

Think about your average user... they are running an installer program... which alerts them that they need to run another program... to determine if they can install the program.... (Which the user thought they were already doing)

The loaded expectation of the user to realize they are granting privileges to a program to determine whether they can install a program is just totally unreasonable.

It just sounds more and more ridiculous written out like this.

<comment><USER14> On top of this, a standard install asks for permissions, but doesn't disclose who/what is asking for it (certified in some way) or what permissions it wants, if these are temporary for the install or permanent for the application, or what it is going to do during the install (what goes where, what gets changed etc).

It is long past time for Apple to improve this process.

</comment></comment></comment></comment><comment><USER15> I think this also shows how macOS has been training users to enter their password in random dialogs that have absolutely nothing that identifies them as being legit OS dialogs. The dialog that Zoom uses could very well be sending the credentials to a remote server, and the user would be none the wiser.

<comment><USER16> Note that in this case, it's still a legit OS dialog. Preflight scripts are very much built into the macOS pkg format, they're just not intended to be used like this.

<comment><USER17> I never understood why Apple still supports the pkg format. It seems a half- baked leftover from the 2000s and even then I was already surprised that there is no way to uninstall things through the macOS GUI. I am not sure if this has changed (I try to avoid pkg files and use Homebrew cask to uninstall such packages), but IIRC you had to list the files with _pkgutil_ on the command- line, remove stuff by hand and then _\--forget_ the package.

They should just kill the format. Everything should just be drag to install, drag to trash to remove.

<comment><USER18> In my experience I've seen even technical users (Who were used to windows) struggle with the idea of dragging an .app from an open disk image to the Applications folder. They would end up running the app from the disk image and then getting confused when it disappears after restart.

<comment><USER16> This system worked so much better when the Applications folder was placed in the Dock by default, and everyone used that folder launch applications (which weren't common enough to keep in the Dock directly).

It was actually a really beautiful synergy—you install applications by copying them to a folder, and launch them from that folder. Same way you'd acquire and open files. Lovely.

Then Apple ruined it in Lion with Launchpad. Their app install flow for anything outside of the app store doesn't make any sense.

<comment><USER14> In even earlier days, applications didn't need to be installed at all. You just ran them from wherever they were _. Of course, it made sense to store them somewhere together, and you could cause yourself problems if you put applications onto disks you then ejected_ _. But the current system is clearly influenced by the UNIX underpinnings, and I 'm not sure that the average user fully "gets it".

_ though preferences files were a bit of a mess.

 __I vaguely remember if early Macintosh System versions you would be prompted to insert the disk (with the correct disk name in the message) if you tried to open a file belonging to an application which was on an ejected disk.

<comment><USER19> You can still run them from wherever they are. The problem is that users do that once, exit, and then later forget where the app was.

<comment><USER10> There are issues when running from the downloads folder (translocation).

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER20> Not that I'm in favor of this practice, but the one key feature that conference software must have is: it just works™.

Nothing turns you off more from a conferencing solution than: any problem getting it working right now.

When there is just the slightest issue, one person not being able to join, one person not getting voice to work, bad audio, your entire team is blocked/distracted. Which results in a collective distain for the solution and video conferencing as a whole.

This extends to getting the solution working for greenfield installs as simple as possible. Because who knows which non-tech users from which department all need to join and can't figure out how to set the permission in their browser right or install/use the other browser that is compatible.

So sadly, from a functionality point of view, you want have the software be able to force itself onto the user in the most usable state it can.

<comment><USER21> I'm still curious why everyone thinks Zoom "just works" while others don't. Because in an enterprise context it is often hard to download an executable and run it with sufficient permissions. While Google and Microsoft both offer a product that "just works" with only a browser. What makes Zoom more "just works" than that?

<comment><USER22> I'm a college professor, and I'll share my perspective.

For one, Zoom _did_ just work. (At least as a participant, rather than an organizer.) I tried it out, and it immediately worked. It did what all of us were expecting, with no fuss.

I also tried MS Teams. It seems designed with a different philosophy: that you use the software to do many different things, and you want them all integrated. (For example, it posted my meetings automatically to my Outlook calendar. I had never used this calendar before, and was only dimly aware that it existed.)

Moreover, it seems that the expected setup is a bunch of people, all at the same workplace, who communicate with each other consistently. My needs are different, with wildly disparate use cases: a departmental meeting; classes to teach; an online conference ([https://www.daniellitt.com/agonize/);](https://www.daniellitt.com/agonize/\);) an online social gathering. Many of the people with whom I communicate don't work for the same employer. And I don't want to configure all of these "teams" in advance.

That said, I tried to get MS Teams up and running, to teach my class. This involved multiple emails back and forth to our tech support (it seems that I can't set up a "team" myself; I have to ask IT to do it for me). It didn't have its own whiteboard functionality so I had to download and run some separate software.

And, then, in the end... it didn't work. I was trying to teach a class, but my students couldn't see what I was doing. I had no idea why.

<comment><USER23> Zoom doesn't just work. If the students want privacy, they are just helpless.

Edit: downvoted for speaking up for student rights. Sorry if it is inconvenient for the teachers

<comment><USER22> > If the students want privacy, they are just helpless.

This isn't true actually. As a student, send the following email:

"Hi Professor, I just read this webpage [link], which outlines some privacy concerns with Zoom. I know some other classes are running Software X, could we try that instead?"

My university isn't _mandating_ Zoom. Indeed, they recommended several software packages, of which their top recommendation was Blackboard. (Which is what I've been using so far. I have mostly joined others' Zoom meetings; I've only initiated them for a D+D game I'm participating in.) MS Teams was their second recommendation as I recall, and Zoom was below that.

At least at my university -- and I expect that this is typical -- individual faculty members are deciding how to best fulfill their own responsibilities. And I have emphasized to my students that I have never done this before, and that I'm happy to change what I'm doing if people have good suggestions.

<comment><USER10> > "Hi Professor, I just read this webpage [link], which outlines some privacy > concerns with Zoom. I know some other classes are running Software X, could > we try that instead?"

Hi [Student],

I appreciate your concern; however, our university has conducted a thorough audit of this software and found that it satisfies our needs. We will continue using it for our lectures.

Regards, Dr. [Professor]

Senior tenured chair of [Department], distinguished lecturer, [University]

</comment></comment></comment></comment></comment></comment><comment><USER24> As someone who's never used or seen Zoom in action, what's pulling people into Zoom that's not already available in other tools (Hangouts Meet, MS Teams) and even works without installing anything (such as Jitsi)?

Based on what I've seen, there's just so much hostile behaviour by the company (including lying about meeting HIPAA e2e requirements!) and the fact that their _official client_ had parts removed by the macOS malware removal tool that I just don't get why people still consider it as an option. If it were the only "just works" tool out there I'd understand, but there's plenty of competition in this space.

I've personally began using the Jitsi server the local student network association has set up and it's been working like a dream. You can even share a window to others (which I didn't even know browsers had support for) for presentations and such.

<comment><USER25> I use Zoom, Hangouts, Slack and WebEx. Out of those Zoom has the best call quality, and it is the only solution out of the 4 on which huge meetings (50+ persons) are workable.

<comment><USER26> I've been in Google Meet meetings with 100 to 150 participants, it worked fine.

<comment><USER27> Was just on a Zoom call with 656 participants, it it was remarkably better than any other solutions we've tried in the past.

</comment></comment></comment></comment><comment><USER28> I really wish they'd make the client available in the Mac App Store. Not only is the installation experience better than this, things also stay nicely up- to-date. If your company runs an MDM for your Macs, it's easy to deploy apps en-mass to everyone.

<comment><USER10> But then they'd need to opt-in to sandboxing and other "onerous" requirements and couldn't pull shady things like this.

<comment><USER29> Nailed it.

</comment></comment></comment><comment><USER30> Why isn't this categorized a major Mac OS vulnerability? If Zoom abuses preinstall scripts, what's to say others aren't.

<comment><USER31> It's not a vulnerability, as the dialog says "run a program" and prompts for confirmation.

It's up to the user's imagination to consider what a program can do.

The prompt is terribly worded though.

<comment><USER32> It seems macOS could use virtualization or permissions to run these scripts in some throw away environment to get rid of the problem altogether. Preflight check programs shouldn't be able to write anything to disk.

</comment></comment></comment><comment><USER33> Two questions this raises, for me at least:

How do I know I've completely uninstalled all the things Zoom installed?

And, if Zoom provided a separate uninstaller (like many apps do) and it was verified to purge all of the stuff they installed (along with the uninstaller); would that appease people's concerns?

For now I'm sticking with the iOS app for video & their web-based experience for desktop sharing...

<comment><USER34> If you have Homebrew installed, you can run `brew cask zap zoomus` to get rid of all the things (as far as we know) Zoom has installed.

If you prefer to remove it manually, here's the list of files and folders Homebrew will delete on `brew cask zap zoomus`:

[https://github.com/Homebrew/homebrew- cask/blob/a6026e0a36c22...](https://github.com/Homebrew/homebrew- cask/blob/a6026e0a36c22eb4615df96598682f7ae931ebe3/Casks/zoomus.rb#L24-L43)

<comment><USER10> Your list seems to be missing a couple of files that the Zoom uninstaller cleans up.

<comment><USER34> That's deliberate. Homebrew always runs the Zoom uninstaller first before going through the list.

Running the uninstaller is enforced by the `pkg` declaration. See also: [https://github.com/Homebrew/homebrew- cask/blob/a6026e0a36c22...](https://github.com/Homebrew/homebrew- cask/blob/a6026e0a36c22eb4615df96598682f7ae931ebe3/Casks/zoomus.rb#L13)

</comment></comment></comment></comment><comment><USER35> Can someone explain to me what the problem is? If you run the installer, isn't that consent to install the software? That's the whole point of it. I guess this isn't the "Mac way" but this is exactly how I would write an install script if I was slapping together support for other platforms. In fact this is the same way most installers work: it unzips an archive somewhere, then creates the links for remove/launch/etc.

What is the typical install process for software on a Mac?

<comment><USER36> Zoom is using a hook in the macOS installer framework in a way that is not intended.

This is forming a troubling pattern [1]. Zoom will do _anything_ to reduce the number of clicks to start a conference, even if results in a misleading installer prompt or security vulnerability.

[1]: [https://www.zdnet.com/article/zoom-defends-use-of-local- web-...](https://www.zdnet.com/article/zoom-defends-use-of-local-web-server- on-macs-after-security-report/)

<comment><USER37> Many PMs are obsessed with click optimization. I've been told many times that a certain feature of security method is no-go due to it being "too many clicks" full-stop -.-

</comment></comment></comment><comment><USER21> The whole torrent of grey area, just over the line and outright shady behavior at Zoom is a problem in itself even if all the separate instances in isolation aren't grounds to stop using them. Their responses to security issues and today's revelation of misleading marketing on E2E encryption make it clear they're not just making isolated mistakes. Shady is at the core of how they operate, this is an indication that Zoom has a company culture of accepting borderline behavior. Otherwise it wouldn't be so widespread.

As a customer this is a reason for me to stop using Zoom. Not in the last place because I'm quite sure we're only seeing the public tip of the iceberg of all the unacceptable things happening within Zoom.

<comment><USER38> Unfortunately, the current system and people in power seems to not give a damn about security and shady behavior, as long as the thing they are using is working and working well. Zoom is an example of very useful and performant software with shady company behind it, that's why people will continue using it.

Same with Uber, Google and bunch of other companies. It doesn't matter what they do, as their product is helping people enough for people to look past the terrible things.

<comment><USER39> Enterprise customer DO give a damn about security. They can be slow to react, but rules are also there for a very long time. If Zoom doesn't want to loose most of their marketshare in favor of WebEx, they should probably address these issues.

<comment><USER40> > Enterprise customer DO give a damn about security

You are wrong. Even without extensive experience in the space, you can very easily see how even _large_ companies don't secure themselves at all. The US has had equifax recently, and it's not like that was an isolated example either. There just isn't a security culture at the eye-watering heights of corporate upper management and while everyone's as busy making money as they are, there never will be. It doesn't fit into the system, and anyone who tries to change it gets muscled out by people who don't want it to change - <USER2> that is simply what's most efficient.

<comment><USER41> This has been my experience as well. Large companies pay lip-service to security that protects their customers; they want just enough for legal deniability in the event of a breach, but not so much that it impacts operations or profits.

However, they can be...enthusiastic when it comes to security around protecting themselves. If you report an issue with customer information on a public S3 bucket, they might get around to fixing it someday, but if there are "trade secrets" or the like in that bucket, the issue is going to get fixed immediately and someone with a big title probably won't be coming in tomorrow.

</comment></comment></comment></comment></comment><comment><USER42> Also, Zoom's entire engineering team is based in China [1]. China and Chinese companies have no real culture of user centric privacy.

[1] [https://news.ycombinator.com/item?id=22707528](https://news.ycombinator.com/item?id=22707528)

Edit: Why downvote me? I am not trying to stir up flame wars. Saying anything against China has become impossible to do on HN. Voices get drowned despite of raising _real_ legitimate concerns about privacy, especially for a tool used by millions all of a sudden during this pandemic. People should be speaking up on HN. I know, I am not supposed to complain about downvotes on HN, I've read the guidelines.

Edit2: Not able to find the source for Tianjin datacenter, I will reply if I can find it. Please take it with a grain of salt.

Edit3: Holyshit, so much attention on my comment. Redacting unsubstantiated claims and adding more sources that can be traced on the wikipedia section of Zoom privacy criticisms: [https://en.wikipedia.org/wiki/Zoom_Video_Communications#Crit...](https://en.wikipedia.org/wiki/Zoom_Video_Communications#Criticism)

<comment><USER43> Please don't break the site guidelines [1] by going on about downvoting. Your comment has been heavily upvoted. Meanwhile complaints like that linger on as off-topic and false, and don't garbage-collect themselves.

You can use HN Search to verify that HN sees plenty of comments "saying anything against China". The topic is extremely flame-prone because people are wont to hurl generalizations at each other, and worse. Nationalistic flamebait and flamewar is a big problem on HN [2] and destructive of the spirit of this site [1]. Individuals have been attacked here for just for expressing their views while being (or being assumed to be) Chinese, and at least one person was hounded off the site altogether. I'm sure you'll agree that that's shocking and not at all the community we want to be. None of us wants it, but it's easy to get it anyway, once such flames get going.

I don't think your comment was nationalistic flamebait, except insofar as it was rather unsubstantive. Unsubstantive comments on inflammatory topics are guaranteed to come across in a flamey way to some segment of the readership, even when that wasn't your intent. Intent doesn't communicate itself, unfortunately, so the burden is on the commenter to disambiguate [4].

[1] [https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

[2] [https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...](https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=by%3Adang%20nationalistic&sort=byDate&type=comment)

[3] [https://news.ycombinator.com/item?id=21200971](https://news.ycombinator.com/item?id=21200971)

[https://news.ycombinator.com/item?id=21195898](https://news.ycombinator.com/item?id=21195898)

[https://news.ycombinator.com/item?id=19404162](https://news.ycombinator.com/item?id=19404162)

[https://news.ycombinator.com/item?id=22608635](https://news.ycombinator.com/item?id=22608635)

[4] [https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...](https://hn.algolia.com/?dateRange=all&page=0&prefix=false&query=by%3Adang%20burden%20disambiguate&sort=byDate&type=comment)

<comment><USER42> Understood, thanks and accept my apologies. I have some feedback - please make exceptions when discussing fact based discussions around privacy when it is not tending towards flame wars, especially related to Chinese influence and erosion of privacy. I can see why this can lead to flame wars but that's where you should step in and moderate. I just read your links to people getting harrased if they are Chinese, that's not cool.

<comment><USER43> I think my comment addresses this, but perhaps you were replying to an earlier version, or perhaps I wasn't clear enough. What you posted _was_ trending towards flamewar, even though you didn't intend it that way. Telling moderators to "step in and moderate" isn't sufficient to solve this problem. For one thing, we don't come close to seeing all the material that gets posted—there's far too much. We do step in, but we also need users like you to understand the problem a bit differently. If you're going to comment on an inflammatory topic, you need to make sure your comment is substantive, i.e. contains solid information and not just grand claims. And you should be careful to narrow its scope explicitly to what the information supports. Fortunately that should also be enough to make it clear that your intent isn't just to post pejoratives about other people.

</comment></comment></comment></comment><comment><USER44> On a simpler level, zoom on macOS sketches me out in lots of ways.

My macbook's bluetooth will not connect to my earbuds, but only when zoom is running. Other audio recording/playing apps don't affect things at all. What the heck is going on here?!

Scrolling on settings panels is definitely their own home-brewed scrolling functionality. Why?! Was macOS's not cutting it for some reason?

The settings menu is very clearly not using native OS buttons and inputs. Why?! Why build your own? What is that for?

<comment><USER45> > My macbook's bluetooth will not connect to my earbuds, but only when zoom is > running.

that sounds like something related to this bug : [https://www.jeffgeerling.com/blog/2018/airpods-get-stuck- low...](https://www.jeffgeerling.com/blog/2018/airpods-get-stuck-low- quality-16-khz-audio-mode-when-starting-vm)

<comment><USER44> Nice, that's pretty much what I had to do to fix this. I used the bluetooth explorer to force AAC, and force zoom to use the internal MacBook mic

</comment></comment></comment><comment><USER46> I installed the WebEx client for macOS today and it seemed similar, installing almost instantly without going through the normal EULA, volume selection, etc. flow.

It seems like they've stuck their installation flow into an Installer.app _plugin_ which is unusual. I haven't encountered that before, and I'm somewhat surprised the feature exists considering Apple waged war on loading code into first-party software. (The user is prompted before the plugin loads.)

<comment><USER47> Ughhh, this is probably where Zoom got the idea from.

<comment><USER48> Zoom was founded by Eric Yuan, a lead engineer from Cisco's WebEx business unit.

</comment></comment></comment><comment><USER49> For those calling this a security vulnerability in MacOS, isn't this just using a GUI equivalent of "sudo"? There may be a decent argument that a consumer OS shouldn't offer such a sudo-like API to installers, but MacOS probably does this for legacy app support reasons.

IMO the better question in this case is why Zoom needs to be installed as admin on MacOS? After all, the mobile apps and chrome extension don't need those privileges.

<comment><USER10> This is like the GUI equivalent of running "apt install zoom" and the installation script killing the APT process and then running amok with its root privileges.

<comment><USER49> > This is like the GUI equivalent of running "apt install zoom" and the > installation script killing the APT process and then running amok with its > root privileges.

So in that case it seems like there is perhaps an issue on both sides.

\- I understand that the OS API to get root/admin privileges likely exists for legacy app install reasons, but why should any install script even be able to run amok with admin privileges? Shouldn't privileges granted by this API this is using be sandboxed in the extreme? Something this sensitive shouldn't be left to the honor system of the app developer.

\- Independently, I still don't understand why Zoom needs admin privs on Mac when it clearly doesn't need them when installed as a browser extension. I'm using it just fine in Chrome all the time - no admin rights needed.

</comment></comment></comment><comment><USER50> I can't imagine why anyone logs in and uses macOS as an admin user.

First account I create on a new Mac: admin. Then, when setup is done, I login and create my non-admin user account.

This is a good reason for many reasons, this abusive installer being one.

</comment><comment><USER51> To me this implies that the installation process on Mac OS should be improved. The fact that they have to resort to these types of things to make it "just work" for people suggests that the official way of doing things is less than ideal.

They are aiming to make the process completely idiot proof, and good for them. If you've ever watched a nontechnical user try to install an application you'll understand why they had to do all this.

I recently watched One of my friends who has only ever used an iPad and not a laptop try to install an application downloaded from the internet. Things we take for granted like "find your downloads folder" were not obvious. I had to explain what the Finder is, and it seemed laughably not obvious to someone who has never used it before.

</comment><comment><USER52> I understand wanting to reduce friction, but this is the second time Zoom has kinda done something weird and suspect security wise in the name of removing really minor obstacles that users are probably used to dealing with anyway. Considering how many tech companies are using Zoom right now, I would hope they are cognizant that they don't become known as "the company that does sketchy stuff so our IT people say we can't use it"

</comment><comment><USER53> Some background info for those commenters who say that Zoom should be requiring just a web browser because web browsers already have everything needed (aka. WebRTC). TL;DR summary: they want to do their own thing, outside of what the WebRTC standard allows, that's all (and enough reason for not using WebRTC?)

Zoom doesn't want to use the stock H.264 encoder as provided by the browser for WebRTC communication. Instead, they use their own video encoders and decoders (which while still being H.264, it is presumedly better optimized for their use case). WebRTC forces you to use either the H.264 or the VP8 encoder/decoder that the browser provides.

How they do this is by having their own custom application that you have to install. Still, some users have noticed that there is a well hidden web-based version of Zoom, which works by again running their custom encoders, thanks to WebAssembly. Also it seems that their video is transmitted via DataCahnnels [0].

They are not alone. Companies want to provide additional "value" by innovating outside of what the WebRTC standard offers. That's nice and all, although it of course tends to disgregation and incompatibilities in the long run. For this reason, I've heard talks about how future revisions of the standard might explore adding WebAssembly support, in order to allow everyone embedding their own compiled components into their applications [1].

[0]: [https://webrtchacks.com/zoom-avoids-using- webrtc/](https://webrtchacks.com/zoom-avoids-using-webrtc/)

[1]: [https://webrtcbydralex.com/index.php/2019/11/13/webrtc- stand...](https://webrtcbydralex.com/index.php/2019/11/13/webrtc-standard- status-update-q3-2019/)

<comment><USER54> Right. It's also important to understand when the reason to build non-standard things are just "productization" (intended to open the wallets of enterprise clients) and when it is because it really provides a better service to the end user.

Having native code running in every client makes a service provider more valuable. It is much the same reason service providers would rather have you running their app on mobile than utilizing the web browser.

This link provides a bit of background to the webrtchack articles above and give a bit of background to when WebRTC is sufficient:

[https://bloggeek.me/webrtc-vs-zoom-video- quality/](https://bloggeek.me/webrtc-vs-zoom-video-quality/)

</comment></comment><comment><USER55> Instead of installing the Zoom software, join Zoom calls from within your web browser

With this trick you can join Zoom calls without ever installing the client on your computer.

Here's how to do it:

1) Uninstall the Zoom client if you have it installed (this is important).

2) When you get a Zoom link to join a meeting, click it to open it in your browser.

3) You'll be asked to download Zoom. Click the "download & run Zoom" link, but don't run the installer.

4) Wait for a few moments and a link to "join from your browser" will appear. Click this and join the call as normal. Most of the features work in this browser based version -- there is no need to ever risk your computer!

Here's a gif demoing what to click: [https://assets.zoom.us/images/en- us/web/client/join-web-clie...](https://assets.zoom.us/images/en- us/web/client/join-web-client.gif)

</comment><comment><USER56> Having never installed Zoom, and honestly not having photographic memory of how the installation process on MacOS is, how is it supposed to look in the installer?

Also, what happened to just dragging the program into the applications folder? I really liked that way of installing apps, but most things seems to have an annoying click-through wizard.

<comment><USER57> They embedded their installation into a pre-install script. Normally, you'd go through a next-next-next process with a pkg installer, but in this case you get a popup asking you if you want to allow it to "run a program to determine if the software can be installed" (the purpose of pre-install scripts) immediately after opening the pkg, you authenticate, and then the installer just disappears.

<comment><USER58> Before that, when they had the shady web server, the zoom application would pop up immediately connected to the right meaning, as your browser would be "waking it up" via http. It looks like they still haven't fixed this after they removed the http server.

</comment></comment></comment><comment><USER19> That Twitter thread has a link to a more detailed analysis that was done all the way back in 2016:

[https://macpkghallofshame.tumblr.com/post/138612887932/indis...](https://macpkghallofshame.tumblr.com/post/138612887932/indistinguishable- from-malware)

</comment><comment><USER59> [https://www.theverge.com/2019/7/8/20687014/zoom-security- fla...](https://www.theverge.com/2019/7/8/20687014/zoom-security-flaw-video- conference-websites-hijack-mac-cameras)

</comment><comment><USER60> If I search my bookmarks for "zoom" every link is about a discovery of it doing some shady shit. At this point I would just classify it as spyware.

</comment><comment><USER61> I have a friend who has some intimate knowledge of MacOS installation software who refuses to use Zoom. "It's not merely because it uses the same install patterns as Russian malware," this person told me, "no; it's personal."

Seriously, despite this person's aversion to anything Google, Hangouts ends up being the one tolerable exception.

</comment><comment><USER62> What I like about zoom is that I can click on a zoom link and it opens up my video conference pretty quickly. Last thing I want is to go through installation steps when people are waiting for me on a call. I understand the security implications but it's a trade-off between user experience and lesser security.

<comment><USER63> People will go through the hassle of booking airline tickets, hotels, taxis and take the time to travel to face to face meetings (and some of them even seem to enjoy it).

But they won't spend 5 minutes installing software properly, or half an hour doing some legwork.

<comment><USER62> The difference is that it's expected that booking airlines and hotels will take time so they make time for it but nobody expects to spend minutes installing video conferencing software properly.

They expect meeting chat software to just work and be as easy as opening a link. If a person needs to fly somewhere they have limited choices with airlines, but if a person gets frustrated with video conferencing software then they have an abundance of alternative options.

</comment></comment></comment><comment><USER64> I have this irrational disgust of .pkg installs, and this is is a good example why. Every time I have to install a .pkg, I wonder what crap it's spreading all around my system.

What's wrong with dragging .apps? Does your app really need to spread its tentacles beyond an app bundle and (maybe) some preference files?

</comment><comment><USER23> > Zoom has been criticized for its data collection practices,[45] which > include its collection and storage of "the content contained in cloud > recordings, and instant messages, files, whiteboards" as well as its > enabling employers to monitor workers remotely;[46][47] the Electronic > Frontier Foundation warned that administrators can join any call at any time > "without in-the-moment consent or warning for the attendees of the > call."[48] The Ministry of Defence of the U.K. banned its use.[49][50] > During signup for a Zoom free account, Zoom requires users to permit it to > identify users with their personal information on Google and also offers to > permanently delete their Google contacts.

Widespread use of Zoom for online education during the novel coronavirus pandemic increased concerns regarding students' data privacy and, in particular, their personally identifiable information.[17] According to the FBI, students' IP addresses, browsing history, academic progress, and biometric data may be at risk during the use of similar online learning services.[17] Privacy experts are also concerned that the use of Zoom by schools and universities may raise issues regarding unauthorized surveillance of students and possible violations of students' rights under the Family Educational Rights and Privacy Act (FERPA)

\- Wikipedia

</comment><comment><USER65> A lot of this is Mac OS X fault: it still does not have an easy canonical way of installing things and has no way for uninstalling. I don't get why in this day mac os can't have something like RPM or any number of other package managers.

<comment><USER10> It very much does! Zoom even stumbled upon it, it's called Installer.app. Except, of course, they killed it before it even finished…

</comment></comment><comment><USER66> Okay, great. Let's wrap some permissions around it to make this a legit process?

</comment><comment><USER67> I wish I knew how it installed on my partner's Mac. No root password was ever given, yet it installed when we thought we were still using the web app. Quickly uninstalled and will use different software next time.

</comment><comment><USER68> I removed Zoom from my Mac following this instruction [0]

Given their security issues as of late, is there further way I could ensure that my machine has completely removed this software?

[0]

</comment><comment><USER69> Are there other app installers that do this? I've got a feeling Zoom is definitely not the only one that does that.

</comment><comment><USER70> Zoom's malware-like behavior is the reason I only use their web app, in a browser with minimal privileges.

</comment><comment><USER71> Discord also does this On Windows at least) and I don't understand how / why it's allowed.

</comment><comment><USER72> Root-kit authors: watch and learn!

</comment><comment><USER73> But why are they doing this? What is the benefit?

<comment><USER74> If I had to guess, it's an attempt to optimize install conversions. Every multi-step process you ask a user to perform is effectively a (marketing/sales) funnel. Some percentage of people drop off at every step. Maybe Zoom they thought that if they moved the actual installation closer to Step 1, then more people would accomplish it. It's awfully sneaky though, especially that password dialog.

<comment><USER75> They could have also made it just work in a web browser without having to use workarounds. That's one of the reasons why I strongly prefer Google Meet and get annoyed at vendors that want me to use solutions that require me to install software.

<comment><USER73> Conversely, I much prefer a desktop app to Google Meet, since that's stuck in the browser the video can't float PIP when you navigate away from the call

<comment><USER10> It can if it uses the right web APIs, which are widely supported: [https://w3c.github.io/picture-in-picture/](https://w3c.github.io/picture-in- picture/)

<comment><USER73> Yes but... it doesn't.

</comment></comment></comment></comment></comment></comment><comment><USER76> Why does Apple allow this?

</comment><comment><USER77> One suggestion...

My company has been using Gotomeeting for 5+ years. No video (thankfully), but meetings are generally 20-30 people and largely seamless.

It is expensive: $300 per seat to host a meeting, but it pretty much just works. The UI is annoying and could be simpler.

However, I don't know if it is as shady as Zoom because I don't think anyone has done a deep dive.

</comment><comment><USER78> resReitna.7z

Reminds me of tech support XD

</comment><comment><USER79> I missed the part where Zoom is holding people's computers for ransom, or formatting the drive, or exfiltrating sensitive information to criminals or state intelligence officers, or mining bitcoin, or other similarly malicious behaviors.

An admin can write to /Applications without privilege escalation? That's a macOS bug. If the operating system didn't rely on an 80s-style put-all-the- executables-in-one-place app launch paradigm, maybe there'd be less incentive for app developers to ignore the per-user Applications folder that macOS supports.

An app can spoof or abuse privilege escalation dialogs? That's because macOS doesn't implement an Orange Book-style Trusted Path. It's why Windows and similar operating systems have secure attention keys in the first place.

So yeah, Zoom is (ab)using flaws in macOS to get itself installed with minimum fuss, but it isn't doing it with evil intent. They fixed past issues; they'll probably fix this. Meanwhile, these long-standing macOS security flaws won't be addressed by Apple, who has a terrible track record about these things except when it lets people bypass their App Store.

P.S. As an enterprise customer, I'm much more worried about end-to-end encryption in Zoom, and the apparent lack thereof. I'm also not sure how that compares with other video conferencing services.

<comment><USER80> > So yeah, Zoom is (ab)using flaws in macOS to get itself installed with > minimum fuss, but it isn't doing it with evil intent.

But... why? What other software vendors look at the OS security model from a viewpoint of 'how do we bypass this as much as possible?' If it's not evil intent, what is it, incompetence?

<comment><USER18> It's about making your software as easy to use as possible.

Users don't like UAC or having to click through a dozen dialogs. They just want to get into their virtual meeting.

<comment><USER81> Then Zoom should just make them join the meeting via the web browser!

Zoom does this somehow and doesn't make joining from the web frictionless when they pretty much could have.</comment></comment></comment></comment>


"Slack vs. Teams" as the world goes remote - <AUTHOR> https://gopractice.io/blog/slack-vs-teams-as-we-go-remote/ <comment><USER2> I think there is a big opportunity for Slack right now. MSFT is pretty much giving away Teams but Slack is still growing, that tells you something.</comment>


Libcurl gets a URL API - <AUTHOR> https://daniel.haxx.se/blog/2018/09/09/libcurl-gets-a-url-api/ <comment><USER2> The blog post mentions WHATWG URL spec and RFC 3986 - what is libcurl's URL parser implementing, what is its goal?

By the way, parsing of URLs is a large-ish task; it'd be nice to have URL API in a separate library, which libcurl depends on, and which can be used without libcurl.

<comment><USER3> > what is libcurl's URL parser implementing, what is its goal?

I get the impression the goal would be "parsing whatever users expect to be able to use as a URL in practice". He's written before about the difficulty of pinning down "the syntax of URLs":

[https://daniel.haxx.se/blog/2016/05/11/my-url-isnt-your- url/](https://daniel.haxx.se/blog/2016/05/11/my-url-isnt-your-url/)

</comment></comment><comment><USER4> This is really excellent, it's the main thing that curb the ruby binding I work on never felt right. We used ruby URL for the parsing and as it turns out it's slightly less forgiving than libcurls internal parser.

</comment><comment><USER5> Serious question: what's the value of using this over [https://uriparser.github.io/](https://uriparser.github.io/) ?

<comment><USER6> It will be consistent with the logic used by the codebase that actually fetches the URL (curl), so it won't leave gaps between the expected behavior and actual behavior the way two disjoint implementations would.</comment></comment>


Storehouse is shutting down - <AUTHOR> https://www.storehouse.co/ <comment><USER2> bummer - whats the next best vendor?</comment>