Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS has checked app signatures online for over 2 years

eclecticlight.co

Post reply on HN
Print view View original

381–390 of 458 posts

Re: macOS has checked app signatures online for over 2 years

#381

Post by 1vuio0pswjnm7 »

nullc wrote: post #2

A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't see. Privacy loss is often irreversible. A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometim…

Perhaps this is why Apple did not ask for permission from the user to add some delay every time the user launches an application. If the user were presented with the choice what would she choose.

If we look at the example of OCSP in the website certificate context, the notion of the delay added by OCSP (not to mention privacy concerns) being objectionable has already been acknowledged. As a result we have OCSP stapling. For some reason, in the Apple developer certificate context, OCSP is deemed acceptable by default.

Re: macOS has checked app signatures online for over 2 years

#382

Post by 8bitsrule »

nullc wrote: post #2

A common refrain in arguments that we don't need laws to protect privacy is that the market will take care of it. The market can't act against what it can't see. Privacy loss is often irreversible. A common refrain in arguments that we don't need to reject closed source software to protect privacy is that being closed source doesn't hide the behaviour, and people will still notice backdoors and privacy leaks. Sometim…

> arguments that we don't need laws to protect privacy is that the market will take care of it.

Since discussion of Apple's behavior in particular has, somehow, been completely de-railed anyway (a frequent happening on HN) ...

Can't help but observe that the market takes the best care of those who control it. Freely.

Re: macOS has checked app signatures online for over 2 years

#383

Post by angry_octet »

ascagnel_ wrote: post #166
dilap wrote: post #102

Earlier quoted context omitted.

Apple has said they plan to do this, and also encrypt the checking payload. Sounds good to me, though definitely a privacy failure that they didn't do this in the first place. The other thing I'd like to see is the app open immediately, w/ the check happening asynchronously in the background. (This seems like super-basic good engineering to me.) No idea if they're planning to fix that or not.

> The other thing I'd like to see is the app open immediately, w/ the check happening asynchronously in the background. (This seems like super-basic good engineering to me.) No idea if they're planning to fix that or not. How would this work? The point of the check is to block malware from running, and opening without the check would, by definition, negate the entire system. If malware authors get wise to the async s…

Surely this check could be done on install/first run, then cached?

If you want rapid blacklisting, a frequent call to Apple to say "anything new blacklisted?" would suffice. Same as push notification.

Re: macOS has checked app signatures online for over 2 years

#384

Post by hu3 »

lawnchair_larry wrote: post #306
mensetmanusman wrote: post #11

The only charitable understanding of this program is that Apple has no actual table connecting software to hashes, but that they could use the information to understand outbreaks of botnets/spyware that they could then help inform ISPs/global law enforcement to help stop. Is this even reasonable?

That is not correct. It does a live check when presented with a certificate, to make sure that certificate has not been revoked for signing malware. It doesn’t store anything. Apple are not saving information. It’s just an online blacklist check. That’s how OCSP works everywhere, it isn’t an Apple thing. They are using the standard protocol as documented in the RFC.

> It doesn’t store anything. Apple are not saving information.

How do you know?

Re: macOS has checked app signatures online for over 2 years

#385

Post by zepto »

Sigmoid wrote: post #378
zepto wrote: post #326

Earlier quoted context omitted.

Any software vendor CAN be nefarious. It is just innuendo to claim it about a particular one without evidence. People don’t risk their privacy by trusting Apple any more than they do by trusting anyone else. Almost certainly less so than by trusting a company that makes money out of personal information. Singling Apple out without evidence is misleading innuendo. If we want people to have the option not to trust priv…

> Any software vendor CAN be nefarious. I'm glad you finally realized this! And thats why people should use FOSS.

I think people should use FOSS, but lying about Apple doesn’t help with that, nor does it solve the problems that FOSS has when it comes to creating a trustworthy ecosystem for end user software delivery.

Re: macOS has checked app signatures online for over 2 years

#388

Post by saagarjha »

kstrauser wrote: post #352
saagarjha wrote: post #347

Earlier quoted context omitted.

That still tells people what you’re running, though.

Imagine you have a shared office DNS resolver (which is pretty common). That resolver would aggregate all of the requests into one shared, cached stream. Then the question becomes "hey Apple, one person of how ever many thousand are behind me would like to know if Adobe's certificate is still valid". That's reasonably anonymized, I think.

That only helps if you have a shared resolver.

Re: macOS has checked app signatures online for over 2 years

#389

Post by hu3 »

zepto wrote: post #359
hu3 wrote: post #325

Earlier quoted context omitted.

"Apple dropped plan for encrypting backups after FBI complained" doesn't sound privacy oriented to me. https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...

Navigating the complexities of dealing with different governments is not the same as having their own anti-privacy agenda. Of course they should encrypt the backups, but perhaps the alternative was going to be some kind of legislation that would be even worse.

> navigating the complexities of dealing with different governments

That's how kids call "handing over all cloud customer data to FBI" these days?

Holy whitewashing batman, that's a lot of speculative mental gymnastics.

To put it simply you have no evidence that supports Apple here other than a "but perhaps the alternative was... whatever I just came up with" .

To paraphrase yourself in another comment: "that's intellectual dishonesty about Apple."

If Apple cared a single bit about privacy it would have encrypted customer data from the begining instead of planning to eventually do it one day only to give up uppon FBI request.

Re: macOS has checked app signatures online for over 2 years

#390

Post by ashtonkem »

reificator wrote: post #364
ashtonkem wrote: post #361

Earlier quoted context omitted.

> You don't have to trust the software, you can verify it or implement your own. This is a common refrain among software people, but in reality approximately 0% of the market actually rewrites such software on their own. Most people can't code, and the percentage of those who have the time, interest, and specialized programming skills to rewrite their own financial software is an incredibly tiny pool. In practice, yo…

I just want to check to see if you read the GP all the way through to the final sentence. You're tearing it apart piece by piece as though the author was making those claims, but you neglected to quote the part of the post that revealed their true opinion. > The minimum required trust is tiny (basically you yourself), but of course as Schneier points out the amount of trust involved in practise isn't nearly as low, a…

My mistake.
Post reply on HN