Application trust is hard, but Apple does it well

Post by 3gg » Sat, Nov 14, 2020, 9:11 PM UTC

alphabettsy wrote: post #89

gamblor956 wrote: post #87

This article must have been written before this week's spectacular meltdown in Big Sur, which resulted because Apple emphatically did not handle application trust well.

I’m not sure how you could come to that conclusion given the first paragraph acknowledges the meltdown. “ On November 12, 2020 Apple released macOS Big Sur. In the hours after the release went live, somewhere in Apple's infrastructure an Online Certificate Status Protocol (OCSP) responder cried out in pain, dropping to its knees, begging for mercy as load increased beyond what it could handle.”

Post by arvindamirtaa » Sat, Nov 14, 2020, 9:29 PM UTC

macintux wrote: post #109

arvindamirtaa wrote: post #80

Earlier quoted context omitted.

Could you switch DNS providers if one fails? Could you have a fallback? What's the parallel here?

The original statement I was objecting to was this: > It is my computer and it should just work how it is meant to be without any external dependencies. DNS is an external dependency, regardless of the level of redundancy.

Post by jb1991 » Sat, Nov 14, 2020, 9:56 PM UTC

fauigerzigerk wrote: post #90

jb1991 wrote: post #25

Earlier quoted context omitted.

Your tone here does not seem proportionally appropriate to the level of discourse this article is attempting. The fact of the matter is that computers offer myriad ways to compromise your life and behave maliciously, and avoiding that is a tall challenge for any company. Apple is trying it their way, and you can try it yours. But to call it Stockholm Syndrome is an unfortunate take on these efforts.

>Your tone here does not seem proportionally appropriate to the level of discourse this article is attempting. You mean this level of discourse? >The privacy squad mobilised on this one - in fact, one blog post recieved a lot of attention for decrying such systems with the dogwhistle "you no longer own your computer!"

Post by FpUser » Sat, Nov 14, 2020, 10:10 PM UTC

torstenvl wrote: post #54

FpUser wrote: post #38

Earlier quoted context omitted.

And of course downvote without having shred of evidence supporting the original claims.

You're getting downvoted because your comment seems like trolling. The reason it seems like trolling is that the information you're demanding "evidence" for is: - the number of elapsed hours since October 7, 2019, when Catalina was released and OCSP became mandatory - the number of hours of outage the other day - how division works None of these seem to be fairly in dispute.

Post by api » Sat, Nov 14, 2020, 10:26 PM UTC

zepto wrote: post #102

api wrote: post #94

Earlier quoted context omitted.

In that case code signing can’t do much either.

On the contrary code signing is the only current solution to this problem. It allows fraudulent, malicious, or easily exploited code to be disabled.