On: Zoom has a signed binary that runs any unsigned script

[cdolan]

I’m genuinely curious how you could prove anything that is applicable to all Mac users (lets say OS 10.5.x through the current version).

Is there an unsigned app/package included with all Mac OS X installs?

[virgilp → cdolan]

Did you even have signed apps (typically) installed in Leopard? Anyway, it depends on the standard of proof. But for the parent comment, it's fairly easy to get most reasonable people to agree that it's false. As a reminder, the claim is about:

> the number of Mac users running 100% signed code

You just have to ask yourself:

- what percent of Mac users run Javascript code

- what percent of Javascript code is signed.

[Twisell → virgilp]

Obviously OP meant outside of sandboxed environment.

There might be exploit out there that exit the sandbox, but they are unintended. But here zoom is intentionaly widening an exploit by being reckless. So thanks to zoom we might now expect even more drastic sandboxing in next MacOS release.

[virgilp → Twisell]

I disagree, not only is it not obvious - it's fairly obvious that he didn't mean that.

> the number of Mac users running 100% signed code is well over 50%

Would you say he meant "number of users running exclusively sandboxed code"? Or do you claim he means "number of users running 100% signed code outside the sandbox"? The only claim that would even make sense is "more than 50% of Mac users run exclusively sandboxed code". And it can't mean "app sandbox", but any kind of sandbox? Like, do java programs qualify? Is the JVM malware? If you install a signed app that requires the JRE, do you also install something that could run unsigned code?