whatever happened to letting the user decide which application they wanted to run? now the mothership has to give their blessing before they let you run it... sounds insane.
Does Apple really log every app you run? A technical look
211–220 of 355 posts
Re: Does Apple really log every app you run? A technical look
#212We have been warned and ignored the warning:
https://prism-break.org/en/
Re: Does Apple really log every app you run? A technical look
#213Earlier quoted context omitted.
Customers, for the most part, don't even know or care it exists. But customers will find value in it when Apple is able to quickly disable malware if it proves necessary. As for developers... I mean, how much of a big deal is it, really? I looked at the documentation and it didn't seem like a huge hassle. It even looks like it is automatable in your CI/CD processes via `altool` and `stapler`.
Ah yes, the fear angle. "We need to restrict what you can do with your computer in order to keep you safe!" No thanks, I'll pass. I do imagine that some people would go for that bargain, but it strikes me as short-sighted.
You do realize that there are millions of satisfied Mac, iPhone, and iPad customers out there, right? The profits speak for themselves: clearly there is value both for freedom and for security. And it never was a binary question anyway.
Besides, you can still run non-notarized binaries if you want to. The UI does make it difficult, but not impossible.
If you want a totally open computer, that's fine (to the extent you don’t spread it via negligence), but everything has tradeoffs. If you're comfortable with the risk of malware, that's also fine; but not everyone is -- and certainly not the business world.
Re: Does Apple really log every app you run? A technical look
#214tldr: no, but yes.
It logs app certificate requests which in real life is pretty much equivalent to logging app runs. And that line about only calling the server from time to time is bullcrap. I have years of experience on this issue because my internet is pretty shitty. And that "from time to time" is every couple of hours.
Re: Does Apple really log every app you run? A technical look
#215Earlier quoted context omitted.
> There is no information on how often the validation happens. I wrote a blog post about this. My analysis indicates that Developer ID OCSP responses were previously cached for 5 minutes, but Apple changed it to half a day after Thursday's outage, probably to reduce traffic: https://lapcatsoftware.com/articles/ocsp.html
5 minutes is an absurdly short cache time…
Let's not forget the inherent elitism of thinking everyone has a gigabit internet at their disposal. I happened to live in a developing county for years and this "waiting up to half a minute until the program opens" has been my daily experience for a long long time.
Re: Does Apple really log every app you run? A technical look
#216There will be a day when all apps on a mac will only be installable from the app store. Developers will be forced to buy macs and subscribe to Apple’s developer program to support it. Customers will be trained to not care. And HN Apple fanboys and fangirls will try to justify why this is a Good Thing(TM).
> Developers will be forced to buy macs Yeah, what's up with that, having to buy a Mac just to run XCode! And having to register as a developer to get a certificate. Apple should bring back Lisas and the UCSD Pascal/Clascal for Mac development like it was in the 1980s. And they should also bring back 4-letter developer signatures. ;-)
You’re being sarcastic... but your premise is wrong. I can build for windows and android from linux without issue. I can build for linux and android from windows without issue. I pay nothing in any direction.
Re: Does Apple really log every app you run? A technical look
#217Earlier quoted context omitted.
Ah yes, the fear angle. "We need to restrict what you can do with your computer in order to keep you safe!" No thanks, I'll pass. I do imagine that some people would go for that bargain, but it strikes me as short-sighted.
You do realize that there are millions of satisfied Mac, iPhone, and iPad customers out there, right? The profits speak for themselves: clearly there is value both for freedom and for security. And it never was a binary question anyway. Besides, you can still run non-notarized binaries if you want to. The UI does make it difficult, but not impossible. If you want a totally open computer, that's fine (to the extent yo…
> Besides, you can still run non-notarized binaries if you want to. The UI does make it difficult, but not impossible.
On ios and ipad (from your first sentence) you cannot.
Re: Does Apple really log every app you run? A technical look
#218There will be a day when all apps on a mac will only be installable from the app store. Developers will be forced to buy macs and subscribe to Apple’s developer program to support it. Customers will be trained to not care. And HN Apple fanboys and fangirls will try to justify why this is a Good Thing(TM).
devs aren't already forced to buy the hardware for the platform they're targeting?
For apple they are 100% forced to. Not sure what you’re getting at but have you ever seen an iphone simulator on windows or linux?
Re: Does Apple really log every app you run? A technical look
#219Earlier quoted context omitted.
5 minutes is an absurdly short cache time…
Let's not forget the inherent elitism of thinking everyone has a gigabit internet at their disposal. I happened to live in a developing county for years and this "waiting up to half a minute until the program opens" has been my daily experience for a long long time.
If it's slow in developing countries, it is gonna be slow in smaller towns as well as rural areas in US and Canada, and depending on where the closest Apple server is, perhaps all of Australia and New Zealand.
Re: Does Apple really log every app you run? A technical look
#220Now just waiting for the trolls to write some software that makes the response always cause it to be invalid. With a wee bit of ARP magic, you could make a bunch of mac users very unhappy at the cafe's.
OCSP responses are signed, so no, that doesn't work.
Evidently it does work if you simply suppress the response.