macOS unable to open any non-Apple application • Hacker News Board

Re: macOS unable to open any non-Apple application

#211

Post by loeg » Thu, Nov 12, 2020, 10:28 PM UTC

valuearb wrote: post #137

loeg wrote: post #113

Earlier quoted context omitted.

The URL mentioned in sibling comments suggests this has to do with certificate revocation (OCSP): https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot... I agree that breaking system availability when an OCSP server isn't available is user-hostile and unnecessary.

What’s the alternative tho?

A limited change would be to fail-open more of the time, e.g., if the OCSP server does not respond within a few milliseconds. (MacOS already fails-open in some internet scenarios.)

A better option is to asynchronously update a Certificate Revocation List ("CRL") and perform any check local to the machine. This avoids disclosing to Apple every single time you run a program, which program it is, and what network you're on. It could also emergency-revoke certificates just as quickly as the OCSP design by polling at the same frequency (every app startup).

Re: macOS unable to open any non-Apple application

#212

Post by sojournerc » Thu, Nov 12, 2020, 10:28 PM UTC

valuearb wrote: post #170

_iyig wrote: post #124

This is the reason I needed to switch to a Linux laptop. I cannot be beholden to Apple’s - or anyone’s - servers when it comes to running applications on my own machine. Any recommendations? I’ve heard good things about System76.

Linux performs similar checks.

You've stated this several times in this thread. Do you have a source for your claim?

Re: macOS unable to open any non-Apple application

#213

Post by Aperocky » Thu, Nov 12, 2020, 10:28 PM UTC

twoodfin wrote: post #4

I don't know if the slow downloads of Big Sur are related, but the underlying problem is that ocsp.apple.com[1] is fubar, and certificate revocation lookups are failing. EDIT: This might indeed be Big Sur-release-day related. Most certificate revocation failures are "soft", but with ocsp.apple.com black-holed in /etc/hosts I can't resume downloading the update. [1] https://twitter.com/lapcatsoftware/status/1326990296…

Talking about a cluster.

Now when I get my new mac, I'm going to find a way to opt out of this.

Re: macOS unable to open any non-Apple application

#214

Post by swiley » Thu, Nov 12, 2020, 10:29 PM UTC

elmo2you wrote: post #202

Sincerely and without any intention to troll or be sarcastic: I'm puzzled that people are willing buy a computer/OS where (apparently) software can/will fail to launch if some central company server goes down. Maybe I'm just getting this wrong, because I can honestly not quite wrap my head around this. This is such a big no-go, from a systems design point of view. Even beyond unintentional glitches at Apple, just ima…

I think the problem is that almost all the software you buy a mac for (or even things that mac users like) has this built in but calls to the developer's servers instead.

Consumer and commercial software is just all bad.

Re: macOS unable to open any non-Apple application

#215

Post by fortran77 » Thu, Nov 12, 2020, 10:29 PM UTC

It's outrageous that Apple designed their system this way. (And it's curious why they seem to have so many fans on Hacker News that will defend this type of design.)

Your Mac hardware is a brick if Apple's servers aren't running!

Re: macOS unable to open any non-Apple application

#216

Post by merb » Thu, Nov 12, 2020, 10:29 PM UTC

draebek wrote: post #41

submeta wrote: post #2

Unbelievable. When I read the tweet (tried to post here as well), I suddenly realized why my Mac was unresponsive an hour ago. Here is another tweet that describes the problem in more detail: https://mobile.twitter.com/llanga/status/1326989724704268289 > I am currently unable to work because macOS sends hashes of every opened executable to some server of theirs and when `trustd` and `syspolicyd` are unable to do so,…

Note that it's ocsp.apple.com, not oSCp.apple.com.

dns is case insensitive

Re: macOS unable to open any non-Apple application

#217

Post by read_if_gay_ » Thu, Nov 12, 2020, 10:29 PM UTC

mikestew wrote: post #85

Captain Pedantic checking in, should not the title simply be "Macs unable..."? I don't see anything MacBook Pro-specific.

Yeah, I had this issue on a Hackintosh.

Re: macOS unable to open any non-Apple application

#218

Post by merb » Thu, Nov 12, 2020, 10:31 PM UTC

loeg wrote: post #113

vsskanth wrote: post #20

Earlier quoted context omitted.

Can apple not use security certificates to verify publishers ? why does it need to go to their servers ?

The URL mentioned in sibling comments suggests this has to do with certificate revocation (OCSP): https://en.wikipedia.org/wiki/Online_Certificate_Status_Prot... I agree that breaking system availability when an OCSP server isn't available is user-hostile and unnecessary.

actually I think the problem is not that it is not available, heck /etc/hosts fixes wouldn't work than. it's that it is unresponsive as hell, and they have no system wide circuit breaker, if it is slow.

Re: macOS unable to open any non-Apple application

#219

Post by the_duke » Thu, Nov 12, 2020, 10:31 PM UTC

_iyig wrote: post #124

This is the reason I needed to switch to a Linux laptop. I cannot be beholden to Apple’s - or anyone’s - servers when it comes to running applications on my own machine. Any recommendations? I’ve heard good things about System76.

Linux runs perfectly fine on most laptops nowadays - pick whatever you like.

(it's still prudent to Google for compatibility before the purchase though, since sometimes peripherals (like the webcam) on new models can be problematic)

Re: macOS unable to open any non-Apple application

#220

Post by [deleted] » Thu, Nov 12, 2020, 10:31 PM UTC

valuearb wrote: post #142

Lammy wrote: post #33

Maybe it's just me but the idea that my computer lets Apple (+ any LE organizations) surveil my app launches seems so much scarier than any malware.

Why is it scary that your computer checks for malware? It’s not like Apple us building a database of apps you’ve launched linked to your address and social security number.

[deleted]