Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS has checked app signatures online for over 2 years

eclecticlight.co

Post reply on HN
Print view View original

91–100 of 458 posts

Re: macOS has checked app signatures online for over 2 years

#91

Post by danShumway »

cdubzzz wrote: post #51
pfortuny wrote: post #31

Earlier quoted context omitted.

Because when you browse the Internet you know you are browsing it. When you run software, you do not expected "unexpected" Internet use. You go for a walk, you carry an umbrella, or go dressed. You are at home, you do not expect it to "rain" or for someone to "watch you".

That seems incredibly naive. I can’t think of a single program off the top of my head that doesn’t use the Internet to some extent while running. Even many CLI tools I use for development do update checks (and sometimes analytics) in the background.

> I can’t think of a single program off the top of my head that doesn’t use the Internet to some extent while running.

What OS are you using? Purely off the top of my head, Linux programs I don't expect to be regularly connecting to the overall Internet in the background (at least unless I set an explicit opt-in setting or use a user-initiated action):

- Keepassxc

- Krita

- Blender

- Nearly all of my CLI tools

- digiKam

- VLC

- Audacity

- etc...

Programs I have that do check for updates or otherwise send activity to the Internet on boot:

- Firefox

- Calibre

- Emacs (Spacemacs)

- (Probably) something somewhere else that I'm forgetting?

Admittedly, I'm kind of cheating by using Linux instead of Windows/Mac. Those are OSes that don't have good update managers, so many apps manage updates themselves.

But even with those apps, there's a difference between an app itself initiating an Internet connection opportunistically in the background, and an app initiating an Internet connection that actually interrupts the app from launching. Very few of my native apps (side-eyes Emacs irritably) will stop working or freeze on boot if their update server is down or responding slowly.

Remember that the reason people found out about this in the first place is that they went to start launching apps on their Macs and found out none of them would start. That's the kind of behavior I would expect from a web browser if some global server was getting hammered (even if I would still be irritated to see it), but that I basically never expect for a native app.

Re: macOS has checked app signatures online for over 2 years

#92

Post by user-the-name »

makeworld wrote: post #89
user-the-name wrote: post #70

Earlier quoted context omitted.

It is not possible to accurately connect an identity with an IP address. Many computers share IP addresses, and many others jump IP addresses frequently.

Many computers don't share IP addresses too. And there are times when there is only one macOS under an IP. This is not something to just wave away.

The point is, this information is UNRELIABLE.

Apple has access to information that is ACTUALLY RELIABLE.

However, they choose to not use the reliable information.

Why would you see this, and assume that they, on purpose, decided to NOT use the reliable information, but instead use unreliable information to spy on you?

Why would they do something so bone-headedly stupid?

Re: macOS has checked app signatures online for over 2 years

#93

Post by oarsinsync »

_puk wrote: post #52
absolutelyrad wrote: post #20

Earlier quoted context omitted.

The market only acts fairly when the product is a commodity. The time for the market to react for a product with the complexity of a mac is decades. As the ecosystem grows, the cost of switching increases. Therefore market starts acting more and more inefficiently. This is why countries have state intervention in such cases. And anti trust exists. If the option was a mac with privacy vs a mac without privacy but $10…

Whilst I agree with the sentiment, it does occur to me just how many kindles I see with ads. Is there any data released on ads Vs no ads versions? That's the closest comparator I can think of.

> Whilst I agree with the sentiment, it does occur to me just how many kindles I see with ads.

> Is there any data released on ads Vs no ads versions?

Do they offer a tracking vs no tracking option too? The absence of adverts does not mean the absence of tracking.

Re: macOS has checked app signatures online for over 2 years

#94

Post by user-the-name »

mensetmanusman wrote: post #79
user-the-name wrote: post #21

Earlier quoted context omitted.

The requests contain only app hashes. They do not contain the unique hardware identifier that Apple computers have. They do not contain your Apple ID, identifying you as a user. Why would you not interpret this charitably as them not actually trying to spy on you? If they wanted to spy on you, why on Earth would they not send the actual valuable information?

Your IP address can be pretty accurately matched to an identity due to PRISM. Has a third party verified they don’t keep track of IP addresses?

An Apple ID is tied to an identity right now. They don't use it. Why?

Re: macOS has checked app signatures online for over 2 years

#95

Post by danShumway »

user-the-name wrote: post #70
m463 wrote: post #57

Earlier quoted context omitted.

I believe you are trying to think about this rationally, but this is not the only thing going on. When a mac boots up or changes network location, a long list of processes on your machine (like AppleIdAuthAgent, identityservicesd, , and maybe 10 or 20 more) connect to various apple servers associating your actual identity with the ip address. It will continue to do these kinds of things while you are online. And all…

It is not possible to accurately connect an identity with an IP address. Many computers share IP addresses, and many others jump IP addresses frequently.

Shoot, apparently those Tor devs have been completely wasting their time.

Somebody in the security industry should let them know that their work on the network level is useless and unnecessary because leaking IP addresses isn't a real privacy threat.

Re: macOS has checked app signatures online for over 2 years

#96

Post by eternalban »

simias wrote: post #9
nullc wrote: post #2

A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't see. Privacy loss is often irreversible. A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometim…

> The market can't act against what it can't see. Privacy loss is often irreversible. You're not wrong, but on the other hand has "the market" shown any serious signal that it cares about privacy? From what I can see people seem more than glad to trade privacy and personal information for free services and cheaper hardware. Take Samsung putting ads on their "smart" TV's UI and screenshotting what people are watching…

> You're not wrong, but on the other hand has "the market" shown any serious signal that it cares about privacy?

Is there a pro-privacy Google out there whose products languished while Google's succeeded?

The Silicon Valley VC network did not fund nor support companies that promoted privacy. I can not think of a single example.

Not a single major venture from SV VC network even attempted to innovate the "business model". We can make machines reason now but, alas, a business model that does not depend on eradicating privacy is beyond the reach of the geniuses involved. It is "Impossible"? I think, "undesirable" is more likely. No one is even seriously trying. Point: money behind SV tech giants is not motivated at all to fund the anti-panopticon.

The salient, sobering, facts are that all these companies are sitting on a SV foundation that was and remains solidly "national security", "military", and "intelligence". The euphemism used is to mention SV's "old boy network".

https://steveblank.com/secret-history/

Re: macOS has checked app signatures online for over 2 years

#97

Post by jaredklewis »

nullc wrote: post #2

A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't see. Privacy loss is often irreversible. A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometim…

Yes, unfortunately there is no safe harbor.

Companies can make mistakes or add backdoors and we won't know. See this clusterfuck.

Open Source, likewise, can make mistakes and (much more rarely) add backdoors, and we could know, but few have the resources to so. See heartbleed.

Re: macOS has checked app signatures online for over 2 years

#98

Post by jrochkind1 »

krzyk wrote: post #85
jrochkind1 wrote: post #73

Earlier quoted context omitted.

The MacOS OCSP feature has been documented to be non-functional when there is no internet connection, it does not interrupt or slow down any functioning in that case.

Just like the sibling poster replied, it is not the issue of "no Internet". You have three cases here: 1. Working internet connection 2. Slow internet connection 3. No internet connection Everything works fine in 1 and 3, but breaks the OS when in 2 (and it is very common, just walk further from your router and you'll notice it - e.g. when waking up the mac from sleep). What is strange to me is that I had an old Macb…

That does sound like a bug, and if that's what's going on it makes me question Apple's technical excellence if they forget to put a reasonable timeout on a network call in such a high-impact place. This bug is not really about privacy though.

Re: macOS has checked app signatures online for over 2 years

#99

Post by user-the-name »

danShumway wrote: post #95
user-the-name wrote: post #70

Earlier quoted context omitted.

It is not possible to accurately connect an identity with an IP address. Many computers share IP addresses, and many others jump IP addresses frequently.

Shoot, apparently those Tor devs have been completely wasting their time. Somebody in the security industry should let them know that their work on the network level is useless and unnecessary because leaking IP addresses isn't a real privacy threat.

Accurately. The key word in there was "accurately".

Re: macOS has checked app signatures online for over 2 years

#100

Post by nullc »

internet_user wrote: post #26
nullc wrote: post #2

A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't see. Privacy loss is often irreversible. A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometim…

which IETF drafts and patents? Can you point me to some links? tia

Sure, lemme give you an example:

https://tools.ietf.org/html/draft-cavuto-dtcp-00

This protocol was created so that monitoring infrastructure could reprogram asic-based packet filters on collection routers (optical taps feed routers with half-duplex-mode interfaces), which grab sampled netflow plus specific targets selected by downstream analysis in realtime. It has to be extremely fast so that it can race TCP handshakes.

I don't think it's much of an exaggeration to say that the technical components of almost all the mass surveillance infrastructure is described in open sources. Yes, they don't put "THIS IS FOR SPYING ON ALL THE PEOPLE" on it, but they also don't even bother reliably scrubbing sigint terms like "tasking". Sometimes the functionality is described under the color of "lawful intercept", though not always.

One of the arguments that people made against the existence of widescale internet surveillance -- back before it was proved to exist-- was that it would require so much technology that it would be impossible to keep secret: the conspiracy would have to be too big. But it wasn't kept secret, not really-- we just weren't paying attention to the evidence around us.

For a related patent example: https://patents.google.com/patent/US8031715B1 which has fairly explicit language on the applications:

> The techniques are described herein by way of example to dynamic flow capture (DFC) service cards that can monitor and distribute targeted network communications to content destinations under high traffic rates, even core traffic rates of the Internet, including OC-3, OC-12, OC-48, OC-192, and higher rates. Moreover, the techniques described herein allow control sources (such as Internet service providers, customers, or law enforcement agencies) to tap new or current packet flows within an extremely small period of time after specifying flow capture information, e.g., within 50 milliseconds, even under high-volume networks.

> Further, the techniques can readily be applied in large networks that may have one or more million of concurrent packet flows, and where control sources may define hundreds of thousands of filter criteria entries in order to target specific communications.

Post reply on HN