Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Application trust is hard, but Apple does it well

security-embedded.com

Post reply on HN
Print view View original

201–210 of 213 posts

Re: Application trust is hard, but Apple does it well

#201

Post by furi »

zepto wrote: post #82
arvindamirtaa wrote: post #78

Earlier quoted context omitted.

> Obviously I still own the car. Do you still own the car if it'll just turn off the engines when attempt to drive into a sketchy neighbourhood? Let's assume the car manufacturer knows the city/town's crime rates well and they have your best intentions in mind. They want you to be safe. Do you still own the car?

If I bought a car knowing that is how it worked, then of course I do. Note: I agree that scenario isn’t desirable. However there is no slippery slope.

The problem isn't that they make decisions about what the device can and can't do before the moment of purchase. As you correctly pointed out in another comment they made the implicit choice to not ship it with the ability to make pizzas and everybody thinks that's fine.

The problem is that they (have the ability to) continue to make those decisions afterwards. You could have "known" an iPhone could run Fortnite at the moment you bought it and then after you received it in the mail discovered that they had decided you were no longer allowed to do that.

You could then say "well I bought it knowing they had the ability to change anything at any time" but I'm not sure I agree that you can give informed consent to a blank check.

Re: Application trust is hard, but Apple does it well

#202

Post by [deleted] »

xvector wrote: post #147
alpaca128 wrote: post #142

Earlier quoted context omitted.

Should we also get rid of photoshop because users could lack practice drawing and feel frustrated while trying to improve? After all they could just google a couple nice images and be done with it. We learn from mistakes, not from success.

Mistakes in the modern world can have devastating consequences. It’s not as simple as your computer freezing up and becoming part of a bot net. Your files will be stolen, your accounts hacked, you will lose money. Most users would gladly take protection from that as opposed to “learning” by making mistakes (getting infected).

[deleted]

Re: Application trust is hard, but Apple does it well

#203

Post by alpaca128 »

floatingatoll wrote: post #146
alpaca128 wrote: post #140

Earlier quoted context omitted.

How would that be better than all the freedom but with good default settings? You're not forced to tinker with all controls, and if you don't agree with a default you can actually do something about it instead of saying "well, that multi-billion dollar company probably knows better what I need".

What settings are you unable to tinker with in macOS Big Sur? Are we discussing generic theoreticals or are there actually specific settings you think you don’t have the freedom to modify? I haven’t seen anyone say “I can’t modify this setting on Big Sur” and have that inability remain unsolved for more than an hour, yet there’s a huge ruckus about lost freedoms, so I’d love to understand where the rubber meets the r…

How about this whole thread's topic? Can you just turn off OCSP so the Mac doesn't ask Apple servers before running any executable? And I don't mean turning off wifi.

Re: Application trust is hard, but Apple does it well

#204

Post by floatingatoll »

alpaca128 wrote: post #203
floatingatoll wrote: post #146

Earlier quoted context omitted.

What settings are you unable to tinker with in macOS Big Sur? Are we discussing generic theoreticals or are there actually specific settings you think you don’t have the freedom to modify? I haven’t seen anyone say “I can’t modify this setting on Big Sur” and have that inability remain unsolved for more than an hour, yet there’s a huge ruckus about lost freedoms, so I’d love to understand where the rubber meets the r…

How about this whole thread's topic? Can you just turn off OCSP so the Mac doesn't ask Apple servers before running any executable? And I don't mean turning off wifi.

Sure, add it to /etc/hosts, ds flush, done. Everyone knew that half an hour into the event, thanks to lap’s tweet, and some knew it years prior to the outage, too.

Or if the loss of Mac App Store access that results bothers you, write a simple http filter proxy that only rejects gatekeeper OCSP and place it into your Network preferences Proxy section.

macOS won’t stop you. This is all basic decades-old Linux admin knowledge, and the only Mac-specific command is know how to flush the DNS resolver cache without rebooting. I am not yet persuaded of your argument.

What other specific instances do you know of where you think macOS won’t let you do something to your own device?

Re: Application trust is hard, but Apple does it well

#205

Post by AnthonyMouse »

johncolanduoni wrote: post #193
AnthonyMouse wrote: post #168

Earlier quoted context omitted.

> The iOS/App Store monopoly arguments are one thing, but 10% is a monopoly now? It goes the other direction. If you want to develop for iOS you have to get a Mac even if you don't want one. Moreover, this behavior is objectionable regardless of market share, because a platform excluding alternative stores segregates that platform into a different market. If you're a developer whose customers use a Mac, and Apple sta…

That argument applies to literally any product that another business wants to built their own product on. I don’t see how that doesn’t turn into every business being required to make the business model of every other business whose products are built on theirs work in perpetuity. If you make a commercial OS, are you arguing you can’t ever remove any feature in a future version if it would make another company’s produ…

It's not about removing a feature, it's about keeping it there but monopolizing access to it. If the feature goes away entirely, that's fine. And then somebody else can come back and implement it themselves.

But if the company gives themselves access to that feature and not anybody else (even with the permission of the device owner), and restricts anyone else from reimplementing it, that creates a monopoly which they would then be abusing by restricting what competing app developers can do.

Security is the owner of the device controlling what runs on it. Monopoly abuse is the manufacturer of the device doing so against the will of the owner of the device.

Re: Application trust is hard, but Apple does it well

#206

Post by intricatedetail »

quelsolaar wrote: post #148
bobince wrote: post #11

If this unacceptable mess is "doing it well", perhaps the whole idea is doomed and should not be attempting to do it at all. > It comes down to an argument of trust - do you trust Apple is acting in your best interests No. I mean really very obviously no. Neither Microsoft. Nor Google. Why would I assume any company would act in my interests when they have clear incentives to increase their profits and control by act…

I'm entirely fine with people running "Trust" systems. But not when the platforms do it by force. If you want to pay McAfee, or some other service to force your computer to only run trusted code, then that's your choice. I might even be fine if Apple or Microsoft offered it as a service you have to pay extra for. The problem is when one entity can lock down a platform entirely. Its a problem when its not a choice the…

I think we need regulation that any API in the OS cannot be closed and end user should be given all keys. Current situation is untenable.

Re: Application trust is hard, but Apple does it well

#207

Post by jasonv »

Wowfunhappy wrote: post #66
JKCalhoun wrote: post #40

Earlier quoted context omitted.

> Why would I assume any company would act in my interests when they have clear incentives to increase their profits and control by acting counter to them? I get what you're saying, but (as an Apple fanboy) I have to point out that Apple's incentives are to act in your, the customer's, interests since that is what they are selling now. They are differentiating themselves from the Googles by taking user privacy seriou…

Apple is incentivized to push you towards their services—to make installing from the App Store easier than sideloading, and to make first party services more useful than third party services. Those are not my interests. I say this not to ascribe malicious intent—I do not think Apple implemented OCSP to push people towards the App Store. But incentives are funny things, and can cause people and organizations to ration…

I live in a world where those incentives have created a platform where I can buy decent hardware to run the kinds of applications that aren’t available on the preferred platforms. Want a laptop that can last all day, edit 4K, and be operated as an appliance, not a passion project? You’ve got Windows and Apple. I have run Linux forever, from day one, and while it can run the services we need for the whole internet, it’s not desktop viable in the ways Windows and Linux are.

In this argument, I’m not sure that level of product development can be dismissed. I wish Apple had implemented this better, I just bought a Windows machine so I wasn’t dependent on one platform, I’m trying to move towards Linux again (to be aligned with my own values), but the engineering this community wants, and the readiness of the platform & product we can buy any day of the week at Best Buy ... doesn’t exist.

So I, personally incentivized to give Apple a bit of a pass on this one, and hope they iterate this solution in the right direction, and definitely hope they don’t turn the Mac App Store into the iOS App Store.

Re: Application trust is hard, but Apple does it well

#208

Post by zepto »

xvector wrote: post #150
zepto wrote: post #22

Earlier quoted context omitted.

This is an extremely reasonable criticism. Quite unlike most of the critiques we saw on the original post.

Wait, how is “information on which apps you are using can be determined by Apple and/or the government” not valid criticism?

Where did I say it isn’t?

I have agreed with that criticism elsewhere. I also think unencrypted iCloud backups are a very serious problem.

Re: Application trust is hard, but Apple does it well

#209

Post by zepto »

furi wrote: post #201
zepto wrote: post #82

Earlier quoted context omitted.

If I bought a car knowing that is how it worked, then of course I do. Note: I agree that scenario isn’t desirable. However there is no slippery slope.

The problem isn't that they make decisions about what the device can and can't do before the moment of purchase. As you correctly pointed out in another comment they made the implicit choice to not ship it with the ability to make pizzas and everybody thinks that's fine. The problem is that they (have the ability to) continue to make those decisions afterwards. You could have "known" an iPhone could run Fortnite at t…

It’s pretty easy to conclude that Apple will remove software the deliberately breaches their terms of service.

Epic knew it, and the chose to breach the terms of service on purpose to cause this effect. Epic intentionally triggered a contract term that they knew would result in their software being removed from their customer’s devices.

They were given an opportunity by both Apple and the court to restore their software to compliance and still get to continue the lawsuit.

This is 100% Epic’s responsibility.

They could have sued Apple without deliberately breaching the contract, but they chose to make their customers into pawns in their legal strategy.

Re: Application trust is hard, but Apple does it well

#210

Post by furi »

zepto wrote: post #209
furi wrote: post #201

Earlier quoted context omitted.

The problem isn't that they make decisions about what the device can and can't do before the moment of purchase. As you correctly pointed out in another comment they made the implicit choice to not ship it with the ability to make pizzas and everybody thinks that's fine. The problem is that they (have the ability to) continue to make those decisions afterwards. You could have "known" an iPhone could run Fortnite at t…

It’s pretty easy to conclude that Apple will remove software the deliberately breaches their terms of service. Epic knew it, and the chose to breach the terms of service on purpose to cause this effect. Epic intentionally triggered a contract term that they knew would result in their software being removed from their customer’s devices. They were given an opportunity by both Apple and the court to restore their softw…

I don't support what Epic did but whether or not it was justified is irrelevant here. A modification was made to the functionality of your device after the moment of purchase, that remains true regardless. And you could not have foreseen that specific modification to your device unless you worked at Epic and had internal knowledge of their plans.

You effectively need to know what every company in the world is doing to have any real idea what your device is going to be able to do tomorrow. Under those conditions I don't think you can say you were informed when you purchased it.

Post reply on HN