Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does Apple really log every app you run? A technical look

blog.jacopo.io

Post reply on HN
Print view View original

181–190 of 355 posts

Re: Does Apple really log every app you run? A technical look

#181

Post by kelnos »

jrockway wrote: post #29

OCSP doesn't seem like the right protocol for this. Apple should probably just ship you a list of hashes of revoked certificates once a day, and should do the check locally. (Obviously, the global certificate database is too big to send to every user, but Apple should be able to determine the subset of certificates they trust, and the even smaller subset of those that are revoked or compromised.) To me, it sounds lik…

Wild (probably wrong) theory: Apple doesn't want us to know how many developer certs they've had to revoke, and who owned them.

Re: Does Apple really log every app you run? A technical look

#182

Post by zepto »

_qulr wrote: post #173
Spivak wrote: post #157

Earlier quoted context omitted.

If you catch malware in the wild you don’t want to wait half a day for the cache to expire. Negative responses are typically cached for short periods of time. Can you imagine if people cached NXDOMAIN for half a day and someone creating a record had to wait 12 hours for it to go live because someone queried it?

> If you catch malware in the wild you don’t want to wait half a day for the cache to expire. But if you have a cached OCSP response for the cert of a malware author, then you've already launched their app, so it's probably too late.

Plenty of kinds of malware are harmful each time they are launched, not just once.

Re: Does Apple really log every app you run? A technical look

#183

Post by zepto »

zamalek wrote: post #116
the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

> [article] editing your /etc/hosts file. Personally, I wouldn’t suggest doing that as it prevents an important security feature from working. Exactly the apologetic that you are talking about. Everyone has a different security update cadence (e.g. patch Tuesday for Microsoft), but each application launch is not a reasonable one. Given Apple's recent propensity for banning developers who stand against them (whether y…

Apple hasn’t banned any developers who stand against them.

Re: Does Apple really log every app you run? A technical look

#184

Post by kelnos »

otterley wrote: post #146
p2detar wrote: post #119

Earlier quoted context omitted.

Notarization was IMO the first big step towards this. To this day I have not heard anyone, neither devs nor users, wanting this feature. And to devs it has only costed misery and money.

Customers, for the most part, don't even know or care it exists. But customers will find value in it when Apple is able to quickly disable malware if it proves necessary. As for developers... I mean, how much of a big deal is it, really? I looked at the documentation and it didn't seem like a huge hassle. It even looks like it is automatable in your CI/CD processes via `altool` and `stapler`.

Ah yes, the fear angle. "We need to restrict what you can do with your computer in order to keep you safe!" No thanks, I'll pass.

I do imagine that some people would go for that bargain, but it strikes me as short-sighted.

Re: Does Apple really log every app you run? A technical look

#185

Post by zepto »

sneak wrote: post #140
douglasdrumz wrote: post #108

Earlier quoted context omitted.

It's explained in the article, there's a loop if you want to verify a certificate and you need the certificate to verify the certificate

You can do unauthenticated TLS, which is no worse than plaintext HTTP, and foils passive listeners by providing privacy. You could also trust your existing trusted certs (prior to OCSP update) when doing the OCSP update, which, again, is no worse than plaintext HTTP. Apple knows this. They have cryptography experts. Taken in context with their backdooring of their e2e messenger and collaboration with military intelli…

“ I’m not even counting the recent story about Apple’s history of willing collaboration with intelligence agencies to make a custom classified firmware for the iPod to aid in espionage.”

What would this ‘count’ as?

Re: Does Apple really log every app you run? A technical look

#186

Post by sebastien_b »

boogies wrote: post #171
amelius wrote: post #151

Earlier quoted context omitted.

Especially where money is involved.

IMO especially when stock holders wanting a monetary return on investment are involved. I give my money to the FSF every month, because they provide value to me, but not because I expect them to surreptitiously extract it from others and give it to me as cash dividends.

I think that's one of the big problems with public companies, especially those that have "regular people" as their main money maker (the "consumers") - invariably, the company's needs (duty) to make money for their real customers (the shareholders) will take precedence over what would be "the best thing" for consumers.

I wish we could do away with the whole "public company" thing - just imagine how much better Facebook, Google, and countless other companies (yes, Apple too) would be if they were private, and more accountable to their users.

Re: Does Apple really log every app you run? A technical look

#187

Post by novok »

zepto wrote: post #183
zamalek wrote: post #116

Earlier quoted context omitted.

> [article] editing your /etc/hosts file. Personally, I wouldn’t suggest doing that as it prevents an important security feature from working. Exactly the apologetic that you are talking about. Everyone has a different security update cadence (e.g. patch Tuesday for Microsoft), but each application launch is not a reasonable one. Given Apple's recent propensity for banning developers who stand against them (whether y…

Apple hasn’t banned any developers who stand against them.

I've noticed you have a very apple apologetic stance about this issue and are very active in replying to these articles, far more than the typical HN user. It's gotten to the point where I've noticed your username now. Why is that?

Re: Does Apple really log every app you run? A technical look

#188

Post by agency »

dewey wrote: post #110
agency wrote: post #106

Earlier quoted context omitted.

I think there were aspects of PRISM that required cooperation from providers like Google. Like the NSA would send queries to them and they would return emails or what have you that match those queries. Though of course this “cooperation” is required by law.

If there's a court order, (FISA: https://en.wikipedia.org/wiki/Foreign_Intelligence_Surveilla... , or otherwise) companies have to comply. So I don't really see how one can blame a any company for that.

See: the last sentence of my post

Re: Does Apple really log every app you run? A technical look

#189

Post by ethbr0 »

zepto wrote: post #182
_qulr wrote: post #173

Earlier quoted context omitted.

> If you catch malware in the wild you don’t want to wait half a day for the cache to expire. But if you have a cached OCSP response for the cert of a malware author, then you've already launched their app, so it's probably too late.

Plenty of kinds of malware are harmful each time they are launched, not just once.

The risk of launching malware a second+ time seems substantially less than the privacy leak caused by more frequent checks.

Re: Does Apple really log every app you run? A technical look

#190

Post by _57jb »

the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

Agreed.

Call home features can be spoofed by a poisoning type of attack upstream in various forms.

This is not bullet proof and a cop-out with a poor solution for security.

You know who has effective call home features? Vendors that sell to major enterprises. It is a natural progression and a particularly nasty environment to live within.

If they are legitimately trying to protect the brand through force or merely forcefully controlling the app ecosystem... it's an abusive relationship to be in.

The fact this is not configurable without dead lettering the route is all they need to do to show tethering is something they consider as a viable security measure.

I'll pass.

Post reply on HN