Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS has checked app signatures online for over 2 years

eclecticlight.co

Post reply on HN
Print view View original

311–320 of 458 posts

Re: macOS has checked app signatures online for over 2 years

#311

Post by dfox »

lawnchair_larry wrote: post #298
matthewmacleod wrote: post #176

It kind of feels like there's a bit too much noise around this topic. I'm getting the same feeling I did years ago when it was discovered that the iPhone had a historical database of all the locations you'd been to. There were rather a lot of articles about how Apple were "tracking you everywhere you went" and so on. The reason it's similar – they are both dumb, technically bad, and privacy-compromising decisions, an…

This is a basic by-the-RFC implementation. The developer who was assigned this just used existing libraries and followed the protocol. This was a rational move on their part. Especially when mucking with x509 has been historically fraught with vulnerabilities. OCSP has since been improved to increase privacy and security, but the extensions to enable that only considered OCSP in the context of TLS.

Just to correct slightly incorrect perception: there is nothing inherently insecure or vulnerable about X.500/ASN.1/BER/DER parsing, in fact it is probably more sane format to parse than JSON. The perception that it is somehow fraught with parser vulnerabilities comes from various implementations that tried to implement BER/DER parser by transforming something more or less equivalent to ASN.1 grammar into actual parser code by means of C preprocessor macros, which is somewhat obviously wrong approach to the problem, at least in the security context.

Re: macOS has checked app signatures online for over 2 years

#314

Post by zepto »

matthewmacleod wrote: post #176

It kind of feels like there's a bit too much noise around this topic. I'm getting the same feeling I did years ago when it was discovered that the iPhone had a historical database of all the locations you'd been to. There were rather a lot of articles about how Apple were "tracking you everywhere you went" and so on. The reason it's similar – they are both dumb, technically bad, and privacy-compromising decisions, an…

It’s actually not at all obvious how a local list of locations used to power suggestions in maps or Siri, is in any way a compromise of privacy or technically bad.

The only thing that made it sound bad were people saying things like “Apple stores your location history”, knowing that it would create the false impression that Apple was uploading location data to their servers.

This situation is similar in that there are people posting misleading inuendo about Apple having some hidden agenda, but the difference is that there do seem like real design problems with the mechanism this time.

Re: macOS has checked app signatures online for over 2 years

#315

Post by jamesgeck0 »

valuearb wrote: post #274
oblio wrote: post #213

Earlier quoted context omitted.

That's human nature. As soon as something beneficial to few and detrimental to others is banned, those who benefit seek to find other ways to continue benefitting, again to the detriment of others. This doesn't mean we shouldn't continue trying to stop them. And we stop them through laws. Common sense is not that common and human decency doesn't scale.

In the US, the typical citizen commits an average of a felony a day. The legal code and associated regulations are so lengthy no one can read all of them. The tax code alone is 2,600 pages and associated rulings 70,000 pages. When you have so many laws, they can be applied selectively depending on your political status, or to benefit the regulators or their friends. We just caught the sheriff of Santa Clara extorting…

> In the US, the typical citizen commits an average of a felony a day

This is surprising to me. Could you provide examples of such common felonies US citizens commit in ignorance?

Re: macOS has checked app signatures online for over 2 years

#316

Post by cdubzzz »

danShumway wrote: post #308
cdubzzz wrote: post #200

Earlier quoted context omitted.

> Admittedly, I'm kind of cheating by using Linux instead of Windows/Mac. I don’t think that is cheating. I was primarily thinking of my own work development environment in macOS but comparing that to Linux is perfectly valid. Again though, I didn’t mean to say, “I bet you can’t name a single program that doesn’t use the Internet!” I just meant to point out that programs using the Internet are probably a fairly consi…

Almost none of my programs on Linux do that by default, because they're handled by my package manager. Programs like Spacemacs (updating ELPA repos on boot, which I actually kind of think is a mistake) and Calibre (just kind of doing its own thing) are the exception to that rule, but they're pretty rare in my personal experience. Even Firefox doesn't update itself on my Linux box. That's kind of why I was thinking of…

> I do think they would be surprised if that rest request failing meant that the program couldn't launch.

I fully agree. The only point I was aiming to make with my original comment was that the mere act of a program connecting to the Internet “unexpectedly” is by no means abnormal.

> That's kind of why I was thinking of Linux as cheating on some level. Windows/Mac programs basically can't do the same thing, since they don't have the same infrastructure.

MacOS, at least, is definitely headed in that direction with its App Store and the move to Apple silicon.

Re: macOS has checked app signatures online for over 2 years

#317

Post by Sigmoid »

zepto wrote: post #282
Sigmoid wrote: post #275

Earlier quoted context omitted.

"The main difference is that this time around there are people who are claiming that Apple is using the OCSP checks for some kind of nefarious tracking purposes." What proof is there that we should trust Apple? They could tracking for nefarious purposes for all you know. Thats the problem.

That’s true of every single organization and every single individual. You can always justify a conspiracy theory on the basis that you can’t prove a negative like this. Let’s consider another conspiracy theory: “A state actor wants to install spyware, and Apple’s OCSP is a barrier to their goal. They are running an influence campaign to get users to opt out of security protections.” There is no evidence for this theo…

> You can always justify a conspiracy theory on the basis that you can’t prove a negative like this.

Its not about definitively claiming they are being nefarious, its about they CAN be, and Apple isn't transparent enough for us to know if they're not. So its about risk. People can use Apple products, I don't really care, but they risk their privacy when they do, and thats not a risk people should have to take when using an OS.

Re: macOS has checked app signatures online for over 2 years

#318

Post by aftbit »

Someone1234 wrote: post #235
bitL wrote: post #223

Earlier quoted context omitted.

Why can't Apple download all footprints of bad apps locally instead of monitoring every single invocation of apps? Is second execution of an app the same security risk as the first one? That's the design flaw.

You mean bad certificates rather than applications. OCSP can be locally cached, and Apple's implementation does exactly that. But eventually you'll have to refresh the cache and then the implementation needs to be fault tolerant (Apple's wasn't). OCSP leaks what vendors your installed applications are from. The list of leaked certificates changes daily, so any good implementation is going to check again at least seve…

I doubt the full list of hashes of all revoked certs is 100s of MB, and even if it is, the daily update file surely isn't that big.

Re: macOS has checked app signatures online for over 2 years

#319

Post by oblio »

valuearb wrote: post #274
oblio wrote: post #213

Earlier quoted context omitted.

That's human nature. As soon as something beneficial to few and detrimental to others is banned, those who benefit seek to find other ways to continue benefitting, again to the detriment of others. This doesn't mean we shouldn't continue trying to stop them. And we stop them through laws. Common sense is not that common and human decency doesn't scale.

In the US, the typical citizen commits an average of a felony a day. The legal code and associated regulations are so lengthy no one can read all of them. The tax code alone is 2,600 pages and associated rulings 70,000 pages. When you have so many laws, they can be applied selectively depending on your political status, or to benefit the regulators or their friends. We just caught the sheriff of Santa Clara extorting…

Laws can always be applied selectively. They have always been applied selectively.

The point of laws is statistics: you can't discourage everything, you need to discourage enough to have order.

And there is a middle ground between no laws and giving everything up.

Also, I give up my liberties and obey laws in exchange for protection from many nasty things people do when there are no laws.

Based on your examples and vocabulary ("nanny state" is a clear giveaway), you're American. Go live for 5-10 years in a country with lax or non-existent laws and law enforcement. We call those countries bad names for a solid reason.

Re: macOS has checked app signatures online for over 2 years

#320

Post by tonyedgecombe »

ogre_codes wrote: post #283
nullc wrote: post #2

A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't see. Privacy loss is often irreversible. A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometim…

> A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. Stronger privacy laws hurt Google, Facebook, and Amazon far more than Apple. Most of Apple's privacy gaffs are just bonehead moves like this one which shouldn't happen, but also don't drive revenue.

I've always thought Apple's focus on privacy (putting aside the current incident) is rather clever as Google have no way to respond. Any improvements to privacy undermine their business model.
Post reply on HN