Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Application trust is hard, but Apple does it well

security-embedded.com

Post reply on HN
Print view View original

151–160 of 213 posts

Re: Application trust is hard, but Apple does it well

#151

Post by 8bitsrule »

coldtea wrote: post #108
bobince wrote: post #11

If this unacceptable mess is "doing it well", perhaps the whole idea is doomed and should not be attempting to do it at all. > It comes down to an argument of trust - do you trust Apple is acting in your best interests No. I mean really very obviously no. Neither Microsoft. Nor Google. Why would I assume any company would act in my interests when they have clear incentives to increase their profits and control by act…

> If this unacceptable mess is "doing it well", perhaps the whole idea is doomed and should not be attempting to do it at all. Well, "unacceptable mess" are your words. It's totally acceptable to me that there could be issues on a feature / launch that need to be ironed out, unless we're talking about aviation software or pacemakers. If we deemed "unacceptable" any misstep or early issue, we wouldn't even have fire,…

Spin, spin, spin. I learned to distrust Apple's hardware after I bought my last (i)Mac. I've see no reason to think it or its software's gotten more trustworthy.

(The company that released the Apple II manual was trustworthy. That company was buried out behind the shed long ago.)

Re: Application trust is hard, but Apple does it well

#152

Post by lifty »

ArchOversight wrote: post #118
lifty wrote: post #45

Earlier quoted context omitted.

But I don't want to turn it off. I want to benefit from checking the revocation list without sending my data to Apple on every app start, even if I am vulnerable for a few hours, until my computer syncs the revocation list. I want a middle way, not an ON or OFF button.

As this article here: https://blog.jacopo.io/en/post/apple-ocsp/ showcases, Apple doesn't send "my data" on every app start. It sends a hash of the certificate in use to Apple, which happens to be an Apple certificate that is used to sign many applications running on your system. None of your data is being sent to Apple.

So it’s slightly less worse than sending the hash of the app. Still very bad. And as I said previously, depending on a network call to start any app is not ideal.

Re: Application trust is hard, but Apple does it well

#153

Post by craigsmansion »

zepto wrote: post #121
craigsmansion wrote: post #106

Earlier quoted context omitted.

> A lot to people are claiming Apple is a malevolent entity. In context, it is reasonable for him to rebut that. The exclusive "or" in "do you trust Apple is acting in your best interests, or do you believe they're a malevolent entity?" still makes it a false dichotomy. > The straw man you cite isn’t a straw man. It is a solid argument. "if I have the code, build the code, nothing can hide in the code.": is not somet…

Many invalid points, and straw men in your comment. Here are the more important ones: “The argument here is that without Apple taking control of the user's software the user would fall prey to the privacy violating practices of the likes of Google and Microsoft, which is not true. Hence the "lie by omission".” You say it’s ‘not true’. I think it’s quite likely to be true. But more importantly - it’s an argument. Not…

> He hasn’t presented any argument why he should be considered an apologist.

He _literally_ did, himself, in the article he wrote:

"I think the privacy arguments are far-fetched"

and actually acknowledging it verbatim:

"While I'm going to sound like an Apple apologist,"

as in "people who say this are Apple apologists, but I'm only like one if I state it."

> Many invalid points, and straw men in your comment.

Of course.

Re: Application trust is hard, but Apple does it well

#154

Post by foobiekr »

bobince wrote: post #11

If this unacceptable mess is "doing it well", perhaps the whole idea is doomed and should not be attempting to do it at all. > It comes down to an argument of trust - do you trust Apple is acting in your best interests No. I mean really very obviously no. Neither Microsoft. Nor Google. Why would I assume any company would act in my interests when they have clear incentives to increase their profits and control by act…

I do trust apple over a hundred different developers with random practices.

I found out not long ago that a tool I was using had no hygiene practices at all - they grabbed random versions of things they packaged up, had no meaningful audit trail at all, no means to notify (or even awareness that this might be a consideration) essentially no meaningful code review and so on. I noted this because I was investigating a bug for the project and gradually the reality became clear.

At the very least, Apple is one step above mayhem and negligence.

Re: Application trust is hard, but Apple does it well

#155

Post by cle »

coldtea wrote: post #108
bobince wrote: post #11

If this unacceptable mess is "doing it well", perhaps the whole idea is doomed and should not be attempting to do it at all. > It comes down to an argument of trust - do you trust Apple is acting in your best interests No. I mean really very obviously no. Neither Microsoft. Nor Google. Why would I assume any company would act in my interests when they have clear incentives to increase their profits and control by act…

> If this unacceptable mess is "doing it well", perhaps the whole idea is doomed and should not be attempting to do it at all. Well, "unacceptable mess" are your words. It's totally acceptable to me that there could be issues on a feature / launch that need to be ironed out, unless we're talking about aviation software or pacemakers. If we deemed "unacceptable" any misstep or early issue, we wouldn't even have fire,…

> You should read it "do you trust Apple is acting in your best interests OVER any random app you might install or website you visit?".

For much of the software I use, the answer is no. I don't trust that Apple is acting in my best interests over GNU software, for example, not by a long shot. I don't even trust that I could understand if Apple is acting in my interests, because massive corporations like Apple have unparalleled resources they can use to obfuscate their intentions.

Is our best shot at trusting one another to delegate that trust to a notoriously non-transparent corporation with a laundry list of conflicts of interest, obfuscated closed-source software, and that's operated out of a country well-known for surveilling its citizens and citizens of other countries?

Personally I'm not anywhere near ready to accept that that's the best we can do, nor that it's something that we even should do.

Re: Application trust is hard, but Apple does it well

#156

Post by johncolanduoni »

quelsolaar wrote: post #148
bobince wrote: post #11

If this unacceptable mess is "doing it well", perhaps the whole idea is doomed and should not be attempting to do it at all. > It comes down to an argument of trust - do you trust Apple is acting in your best interests No. I mean really very obviously no. Neither Microsoft. Nor Google. Why would I assume any company would act in my interests when they have clear incentives to increase their profits and control by act…

I'm entirely fine with people running "Trust" systems. But not when the platforms do it by force. If you want to pay McAfee, or some other service to force your computer to only run trusted code, then that's your choice. I might even be fine if Apple or Microsoft offered it as a service you have to pay extra for. The problem is when one entity can lock down a platform entirely. Its a problem when its not a choice the…

Mac market share is less than 10% in the US, even lower in other countries. I personally know at least one person who is considering not buying one next time around just because of this incident. Some people use tools that lock them onto a Mac, but most of that is just people that have to develop for Macs (and they’re stuck no matter what Apple does, because they need to test on Macs). The iOS/App Store monopoly arguments are one thing, but 10% is a monopoly now?

Just because a company sells a product that has some things one might want that no other market players bother combined with some things that they don’t like, doesn’t mean they’re “exploiting a monopoly”.

Re: Application trust is hard, but Apple does it well

#157

Post by arvindamirtaa »

zepto wrote: post #125
arvindamirtaa wrote: post #114

Earlier quoted context omitted.

Unfortunately, there kinda is. This is what Tim Cook said about govt agencies wanting a backdoor - https://www.youtube.com/watch?v=BZmeZyDGkQ0 - right around 4:25. When I buy an Apple product, this is part of what I think Apple does to protect their customers' privacy - No matter what, not even if the govt says so. Now suddenly, we're back to talking about whether we can trust Apple after they expressly told us not t…

What has this got to do with a certificate revocation server performing poorly?

Well, nothing other than certificate revocation server performing poorly has got to do anything with certificate revocation server performing poorly per se. None of your comments or mine for that matter. What is your point?

We're discussing the implications of it. You're welcome to not if you think it's irrelevant.

Re: Application trust is hard, but Apple does it well

#158

Post by zepto »

alpaca128 wrote: post #142
zepto wrote: post #132

Earlier quoted context omitted.

If they want to make painful mistakes and learn from them, they can buy a Linux box. If they don’t, they can buy a Mac. Don’t force them to choose an unsafe tool when they don’t want to.

Should we also get rid of photoshop because users could lack practice drawing and feel frustrated while trying to improve? After all they could just google a couple nice images and be done with it. We learn from mistakes, not from success.

A mistake in securing your personal data and ending up the victim of fraud or blackmail is very different from a mistake learning to draw.

But, more importantly - people use photoshop because they want to edit images.

Most people do not buy computers because they want to learn how to defeat cyberattacks.

You know what some users learn after dealing with insecure systems? They learn to buy a Mac.

Re: Application trust is hard, but Apple does it well

#159

Post by _qulr »

zepto wrote: post #139
_qulr wrote: post #98

Earlier quoted context omitted.

> Apple’s restrictions liberate me from having to spend time on fully-liberated computing. This seems to conflate restrictions with defaults. It's reasonable for Apple to configure Macs to be safe "out of the box". But it's not clear why it helps you to prevent other Mac users from changing the defaults.

If you are someone who wants and understands how to use a machine with disabled security features, it obviously doesn’t help to have the defaults be unchangable. For everyone else, it is a very important safeguard against social engineering attacks.

People are social engineered over the phone all the time. Maybe they shouldn't be allowed to have phones or answer phone calls.

Re: Application trust is hard, but Apple does it well

#160

Post by sneak »

coldtea wrote: post #108
bobince wrote: post #11

If this unacceptable mess is "doing it well", perhaps the whole idea is doomed and should not be attempting to do it at all. > It comes down to an argument of trust - do you trust Apple is acting in your best interests No. I mean really very obviously no. Neither Microsoft. Nor Google. Why would I assume any company would act in my interests when they have clear incentives to increase their profits and control by act…

> If this unacceptable mess is "doing it well", perhaps the whole idea is doomed and should not be attempting to do it at all. Well, "unacceptable mess" are your words. It's totally acceptable to me that there could be issues on a feature / launch that need to be ironed out, unless we're talking about aviation software or pacemakers. If we deemed "unacceptable" any misstep or early issue, we wouldn't even have fire,…

Apple has been leaking OCSP app launch data in cleartext for two years. This isn’t a Big Sur release glitch.
Post reply on HN