191–200 of 355 posts
Earlier quoted context omitted.
Apple hasn’t banned any developers who stand against them.
I've noticed you have a very apple apologetic stance about this issue and are very active in replying to these articles, far more than the typical HN user. It's gotten to the point where I've noticed your username now. Why is that?
While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…
There is no justification not to switch to HTTPS here.
While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…
> [article] editing your /etc/hosts file. Personally, I wouldn’t suggest doing that as it prevents an important security feature from working. Exactly the apologetic that you are talking about. Everyone has a different security update cadence (e.g. patch Tuesday for Microsoft), but each application launch is not a reasonable one. Given Apple's recent propensity for banning developers who stand against them (whether y…
Earlier quoted context omitted.
There is no executable hash in the request, so I don't understand why you bring it up
Developer certificate IDs are almost a 1:1 match with which app you’re running.
Earlier quoted context omitted.
... and that apple wants to merge its operating systems
No they don’t. They keep adding new ones. They want to provide a consistent user experience across their ecosystem. Not the same thing.
Earlier quoted context omitted.
Plenty of kinds of malware are harmful each time they are launched, not just once.
The risk of launching malware a second+ time seems substantially less than the privacy leak caused by more frequent checks.
This was a seriously exploitable issue that was a problem every time it was run.
I agree that this certificate mechanism is absurdly problematic.
That doesn’t justify dismissing the security risks it was intended to prevent.
Earlier quoted context omitted.
Wouldn't an anonymity scheme such as [1] work in this context? Send only part of the hash of the app's certificate, and have the server send you all possible revoked certificates? [1]: https://blog.cloudflare.com/validating-leaked-passwords-with...
As the set of certificates is bounded and known by apple, they can also adopt crlite and just push all CRLs they have to all users, using CRLite. https://github.com/mozilla/crlite
You probably can't update the whole list that often though, compared to Apple's current OCSP revalidate time of 5 min. [edit: seems "delta patches" are supported by crlite so maybe that can work too]