Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS has checked app signatures online for over 2 years

eclecticlight.co

Post reply on HN
Print view View original

71–80 of 458 posts

Re: macOS has checked app signatures online for over 2 years

#71

Post by user-the-name »

oauea wrote: post #49
user-the-name wrote: post #21

Earlier quoted context omitted.

The requests contain only app hashes. They do not contain the unique hardware identifier that Apple computers have. They do not contain your Apple ID, identifying you as a user. Why would you not interpret this charitably as them not actually trying to spy on you? If they wanted to spy on you, why on Earth would they not send the actual valuable information?

The request also contains your ip address. Charitable would be distributing a bloom filter and checking matches locally.

Your IP address is a very weak and unreliable way to identify you. If they actually wanted to identify you, they have much better ways to do it, and those ways are not used.

Re: macOS has checked app signatures online for over 2 years

#72

Post by shawnz »

nickpp wrote: post #47

I sometimes wonder if the mods won't end up banning "political" talk on HN. Because these days everything becomes political, even if it really is a technical issue. Case to the point: online signature check was a technical decision, to fight malware. It was implemented similarly by other OS vendors (Microsoft) and it's been this way for years. Now we discover that it has the unfortunate side-effect that it lessens pr…

The technical issue is "can we provide these features without weakening privacy?"

The political issue is "if we can't provide these features without weakening privacy, should we still provide them?"

Aren't they both important points to discuss?

Re: macOS has checked app signatures online for over 2 years

#73

Post by jrochkind1 »

krzyk wrote: post #65
cdubzzz wrote: post #51

Earlier quoted context omitted.

That seems incredibly naive. I can’t think of a single program off the top of my head that doesn’t use the Internet to some extent while running. Even many CLI tools I use for development do update checks (and sometimes analytics) in the background.

> That seems incredibly naive. I can’t think of a single program off the top of my head that doesn’t use the Internet to some extent while running. It is not. Imagine that I don't have that great wifi coverage in all places around the house. But I take my laptop there. You know what happens when you have poor wifi connection and you wake up laptop? Even the keyboard+mouse are unresponsive. I was wondering why on eart…

The MacOS OCSP feature has been documented to be non-functional when there is no internet connection, it does not interrupt or slow down any functioning in that case.

Re: macOS has checked app signatures online for over 2 years

#74

Post by grishka »

woahAcademia wrote: post #55
KingOfCoders wrote: post #4

"Privacy is not a feature".

Directly contradicting current Apple Marketing. I lothe Apple(and other unethical companies) for lying in their ads. Any benefits of macOS are instantly gone because you cannot Trust Apple to tell the truth. It's as unreliable as Google keeping a service around.

Apple's marketing basically boils down to "please trust us that we respect your privacy because we tell you so". You can at least reverse engineer the hardware you own and the software on it, but what about cloud services they're pushing so hard? You don't, and can't, know what happens to your data in someone else's infrastructure.

Re: macOS has checked app signatures online for over 2 years

#75

Post by user-the-name »

lovelyviking wrote: post #44
user-the-name wrote: post #21

Earlier quoted context omitted.

The requests contain only app hashes. They do not contain the unique hardware identifier that Apple computers have. They do not contain your Apple ID, identifying you as a user. Why would you not interpret this charitably as them not actually trying to spy on you? If they wanted to spy on you, why on Earth would they not send the actual valuable information?

>They do not contain the unique hardware identifier that Apple computers have Different part of MacOS can send it and you would have no idea until it malfunction like in this case.

They would not be accurately tied together, though, since these requests are not sent with any kind of identifier.

Re: macOS has checked app signatures online for over 2 years

#76

Post by cdubzzz »

krzyk wrote: post #65
cdubzzz wrote: post #51

Earlier quoted context omitted.

That seems incredibly naive. I can’t think of a single program off the top of my head that doesn’t use the Internet to some extent while running. Even many CLI tools I use for development do update checks (and sometimes analytics) in the background.

> That seems incredibly naive. I can’t think of a single program off the top of my head that doesn’t use the Internet to some extent while running. It is not. Imagine that I don't have that great wifi coverage in all places around the house. But I take my laptop there. You know what happens when you have poor wifi connection and you wake up laptop? Even the keyboard+mouse are unresponsive. I was wondering why on eart…

I absolutely agree with that. And I have experienced a similar issue with my laptop from time to time. It is pretty dumb and seems like poor implementation. I don’t think that is relevant to OPs argument though.

Re: macOS has checked app signatures online for over 2 years

#77

Post by blub »

nullc wrote: post #2

A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't see. Privacy loss is often irreversible. A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometim…

The laws are already there. If you care about this and have some free time you may try to make a complain to the Irish data protection commission.

I'm not sure if it's infringing though. If Apple says that they do not collect personal data and that the information is thrown away and this is done for a legitimate business purpose or for the customers (i.e. protecting customers), it may well be fine according to the GDPR.

Re: macOS has checked app signatures online for over 2 years

#78

Post by ClumsyPilot »

nullc wrote: post #2

A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't see. Privacy loss is often irreversible. A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometim…

Lying to the customer about what your product does, or having secret functionality, should be a criminal offence in the same way as breaking and entering or stalking are.

Then, we would find out very quickly what people value.

I firmly believe this ecosystem (as in privacy violating ad and data selling business model) is only dominant because companies are able to mislead with impunity, so it's basically a form of fraud

Re: macOS has checked app signatures online for over 2 years

#79

Post by mensetmanusman »

user-the-name wrote: post #21
mensetmanusman wrote: post #11

The only charitable understanding of this program is that Apple has no actual table connecting software to hashes, but that they could use the information to understand outbreaks of botnets/spyware that they could then help inform ISPs/global law enforcement to help stop. Is this even reasonable?

The requests contain only app hashes. They do not contain the unique hardware identifier that Apple computers have. They do not contain your Apple ID, identifying you as a user. Why would you not interpret this charitably as them not actually trying to spy on you? If they wanted to spy on you, why on Earth would they not send the actual valuable information?

Your IP address can be pretty accurately matched to an identity due to PRISM.

Has a third party verified they don’t keep track of IP addresses?

Re: macOS has checked app signatures online for over 2 years

#80

Post by cdubzzz »

jrochkind1 wrote: post #73
krzyk wrote: post #65

Earlier quoted context omitted.

> That seems incredibly naive. I can’t think of a single program off the top of my head that doesn’t use the Internet to some extent while running. It is not. Imagine that I don't have that great wifi coverage in all places around the house. But I take my laptop there. You know what happens when you have poor wifi connection and you wake up laptop? Even the keyboard+mouse are unresponsive. I was wondering why on eart…

The MacOS OCSP feature has been documented to be non-functional when there is no internet connection, it does not interrupt or slow down any functioning in that case.

Slow Internet and no Internet are different things though. I have experienced this issue as well — sometimes after boot my regular apps will just bounce and bounce (in the macOS dock) and never start. Then when I plug in to ethernet and shut off my wifi everything all of a sudden fires up and starts working.
Post reply on HN