Hacker News new | past | comments | ask | show | jobs | submit login

They may not be exploiting vulnerabilities but they are breaking the contact with the expectations users have of how installers work.



>with the expectations users have of how installers work

Tbh I think that most people here on hn are experiencing cognitive bias because of additional knowledge - reality is that most of regular users do not give a damn about what installer does, they just want working app.


But why are they even using Installer.app? First, why use an installer at all; second, if they really want an installer, why not make a custom installer app and avoid the "run a script" prompt? Installer.app doesn't have special privileges. Is the script approach just easier?


The built-in installer gives developers a lot of freebies like permission escalation and gets around "hey, you're trying to run a program from the internet" prompt. That is at least until developers start bending over backwards with crazy shell scripts like the one found in the zoom installer.


The interesting thing is that if you hit Command-I and Command-L you can see exactly what the package is doing, and the most recent one just seems to be moving an app to /Applications. For this sort of thing: download a zip, open the zip from your browser's download panel and then have the app move itself to /Applications when you open the extracted app is a much nicer flow that is semi-widespread.


Enterprise deployment?


Being only sub-consciously aware of the difference is still an impact. The repetition of the install process should lead toward more familiarity with how the process works. The zoom and cisco installers are breaking that repetition and replacing it with something unexpected.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: