Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does Apple really log every app you run? A technical look

blog.jacopo.io

Post reply on HN
Print view View original

21–30 of 355 posts

Re: Does Apple really log every app you run? A technical look

#21

Post by musicale »

> You should be aware that macOS might transmit some opaque information about the developer certificate of the apps you run. This information is sent out in clear text on your network.

Wow, that is bad from a privacy perspective!

Since certificate revocation is rare, it makes more sense to simply periodically update a list of revoked certificates instead of repeatedly checking each certificate. That would solve the privacy issue while still allowing certificates to be revoked.

OCSP seems like a bad idea for web browsing for similar reasons.

Re: Does Apple really log every app you run? A technical look

#23

Post by anamexis »

ravenstine wrote: post #16
josephcsible wrote: post #10

Earlier quoted context omitted.

> I never asked them to do that in the first place, so I'll be blocking it from now on. Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816

Isn't that just with Big Sur? Also, I'm using the hosts file method.

The OP is about Big Sur.

Re: Does Apple really log every app you run? A technical look

#24

Post by intricatedetail »

coldtea wrote: post #4
intricatedetail wrote: post #2

Apple should change their name to "Peeping Tim".

A low effort comment. Doubly bad, because the actual post is about how Apple doesn't actually do the "tracks your every use of an app" peeping they original post that made all the fuss says they do.

Learn about Big Sur(veillance). You can't block telemetry and it bypasses any VPN.

Re: Does Apple really log every app you run? A technical look

#25

Post by cute_boi »

josephcsible wrote: post #10
ravenstine wrote: post #5

> macOS does actually send out some opaque information about the developer certificate of those apps, and that’s quite an important difference on a privacy perspective. Yes, and no. If you're using software that the state deems to be subversive or "dangerous", a developer certificate would make the nature of the software you are running pretty clear. They don't have to know exactly which program you're running, but j…

> I never asked them to do that in the first place, so I'll be blocking it from now on. Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816

if they keep doing like this I will block their entire ASN .

Re: Does Apple really log every app you run? A technical look

#26

Post by brendoelfrendo »

pubkraal wrote: post #15

If anyone is concerned with ocsp activity and verifications being requested all over the web, then oh boy stay away from https. OCSP is a good thing, and the web - and your signed applications - are better off with it.

Yeah, I feel like I'm taking crazy pills; did everyone just not know about OCSP until Apple did it?

Spoiler alert, you've probably already used OCSP on the web.

Re: Does Apple really log every app you run? A technical look

#27

Post by lifeisgood99 »

Being able to identify the developer of any app I run on my own machine is already too far. You have to assume all these requests are logged and available for state actors on legal demand.

I wonder how big a local revocation list would be. I would support a on-by-default local check.

Re: Does Apple really log every app you run? A technical look

#28

Post by readams »

sz4kerto wrote: post #8

Can someone explain my why is this significantly less problematic than sending out app hashes? If we accept that most developers don't have many similarly popular apps, then isn't this enough to infer what apps are users running? In the example from the article: if Mozilla's certificate is sent, then it's very likely that the app that has been opened is Firefox, as the a priori likelihood of using Firefox is way high…

It is only very very slightly less concerning than sending the app hashes. Coming to the conclusion that this is all great and fine is really absurd.

Re: Does Apple really log every app you run? A technical look

#29

Post by jrockway »

OCSP doesn't seem like the right protocol for this. Apple should probably just ship you a list of hashes of revoked certificates once a day, and should do the check locally. (Obviously, the global certificate database is too big to send to every user, but Apple should be able to determine the subset of certificates they trust, and the even smaller subset of those that are revoked or compromised.)

To me, it sounds like they decided to take the quick-and-easy path of reusing an existing protocol for the use case of stopping malware, but it doesn't really fit. The latency, privacy, and availability guarantees of OCSP just don't match with the requirements for "run a local application".

Re: Does Apple really log every app you run? A technical look

#30

Post by cute_boi »

ThePhysicist wrote: post #19

Not sure whether the non-privacy related aspect about OCSP is less worrying. Officially Apple does this to protect innocent users from malware, but as we've seen it also allows them to remotely disable any developers' software. Not really something that I'd want on my machine.

is there any statistics of how many innocent users have become victim? Clearly Apple just want control. Just like there is old saying More truth less trust is needed.
Post reply on HN