Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does Apple really log every app you run? A technical look

blog.jacopo.io

Post reply on HN
Print view View original

241–250 of 355 posts

Re: Does Apple really log every app you run? A technical look

#241

Post by martimarkov »

danShumway wrote: post #224
avalys wrote: post #193

Earlier quoted context omitted.

I don’t see how you can so confidently reach that conclusion. It seems perfectly plausible that Apple wants a way to quickly quash malware, worms, etc.

> I don’t see how you can so confidently reach that conclusion. I'm not going to 100% say that control is the reason Apple is doing this. I'm sure that they do genuinely want a way to quickly quash malware, worms, etc... But we've also seen that Apple is clearly willing to use security features to ban developers that stand against them, so I don't understand how people can be so confident that they wouldn't be willin…

Can you remind me of which developers have been banned for standing against Apple AND haven’t broken their contract with Apple?

Re: Does Apple really log every app you run? A technical look

#242

Post by mnahkies »

remram wrote: post #113
fiddlerwoaroof wrote: post #80

Earlier quoted context omitted.

Isn’t OCSP an open standard for handling certificate revocations? The standard specifies plaintext, because the standard can’t assume that the client has a way to form an encrypted connection to the revocation list.

Wouldn't an anonymity scheme such as [1] work in this context? Send only part of the hash of the app's certificate, and have the server send you all possible revoked certificates? [1]: https://blog.cloudflare.com/validating-leaked-passwords-with...

This is pretty much how chrome's safe browsing feature works for screening URLs without leaking the full details.

There is no valid reason that the full information needs to be sent to the server to implement this kind of protection IMO

Re: Does Apple really log every app you run? A technical look

#243

Post by brabel »

samatman wrote: post #203
lowendbeholder wrote: post #192

Earlier quoted context omitted.

The loop argument makes no sense at all. HTTP is being used as a transport for a base64-encoded payload, the actual process of veryfing the validity of the developer certificate is done by the service behind that Apple URL - not by the HTTP stack. There is no justification not to switch to HTTPS here.

Yeah, that confused me as well. Even if there was some wrinkle about the loop argument that I didn't understand, and HTTPS is out: Apple could encrypt the base64 payload, and the sniffable info is reduced to which computer is phoning home, which is something that someone with the ability to middle comms probably knows already. "roll your own encryption and send it over HTTP" is a bad idea in general but... this is Ap…

The OCSP RFC[1] specifies that if requests are made using HTTP, they MAY be protected via TLS or "some other lower-layer protocol".

[1] https://tools.ietf.org/html/rfc6960#appendix-A.1

Re: Does Apple really log every app you run? A technical look

#244

Post by WesolyKubeczek »

kzrdude wrote: post #149
WesolyKubeczek wrote: post #117

Earlier quoted context omitted.

Most "alarmist" articles have two points you cannot really ignore, not if you don't want to end up living in interesting times one day. 1) Even plain access logs — basically what a HTTP request, or a TCP connection can tell you — is a lot . Gather those for a couple of days, and you have a good map of the user. More so if you have an ID of machine and the actual executable hash. 2) "But we are the good guys" is a non…

There is no executable hash in the request, so I don't understand why you bring it up

There are also notarization requests, and those transmit more than enough information about your executable.

Re: Does Apple really log every app you run? A technical look

#245

Post by tgv »

kelnos wrote: post #184
otterley wrote: post #146

Earlier quoted context omitted.

Customers, for the most part, don't even know or care it exists. But customers will find value in it when Apple is able to quickly disable malware if it proves necessary. As for developers... I mean, how much of a big deal is it, really? I looked at the documentation and it didn't seem like a huge hassle. It even looks like it is automatable in your CI/CD processes via `altool` and `stapler`.

Ah yes, the fear angle. "We need to restrict what you can do with your computer in order to keep you safe!" No thanks, I'll pass. I do imagine that some people would go for that bargain, but it strikes me as short-sighted.

Up until now, you could change the settings to something dev friendly, while leaving them strict for people like my father, who clicks on things he shouldn't click on. It is not short sighted, it's a useful protection against malware. The only time he got in trouble was when he ran an installer, entered the admin password and installed one of these "protect your mac" apps that don't protect, but only pester you into paying a subscription. I had to remove that file by file. OTOH, the amount of shit my in-laws' PC went through is unbelievable. They no longer use it: they've got an iPad.

Re: Does Apple really log every app you run? A technical look

#246

Post by whiddershins »

heavyset_go wrote: post #154
macintux wrote: post #91

Earlier quoted context omitted.

We’ve been hearing that for years, yet it hasn’t happened. Apple seems to recognize the value of the Mac as an general computing platform.

Apple has programmed macOS to make it appear to users as if un-Notarized apps either don't work or are malicious. This is bad for users that download apps to solve problems, or to get work done, because then they can't those apps without having an expert tell them what the magic ritual to run un-Notarized apps is. If they don't have an expert around to show them how to perform the magic ritual, then they just think t…

I dunno.

If you can’t confidently change a system preference back and forth, maybe you are very vulnerable to being hacked in general? So maybe it’s ok for Apple’s defaults, at least, to be restrictive?

I just want a preference that allows me to turn all of this off.

Re: Does Apple really log every app you run? A technical look

#247

Post by marcan_42 »

lowendbeholder wrote: post #192
the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

The loop argument makes no sense at all. HTTP is being used as a transport for a base64-encoded payload, the actual process of veryfing the validity of the developer certificate is done by the service behind that Apple URL - not by the HTTP stack. There is no justification not to switch to HTTPS here.

It's convention. With browsers, you wouldn't want to introduce a recursion point in TLS (we already have certificate chains, and now we'd get OCSP check chains and where does that terminate?). Apple just did what everyone else does for OCSP, in a way which is accepted practice for good reasons.

Now in this specific instance, OCSP is being used in quite a different use case. For one, the plaintext issue is not a problem when browsing, as attackers can see what sites/certs you're accessing in the clear anyway (certificates are plaintext in TLS sessions), while app launch is an otherwise offline activity. So in this instance it makes sense for Apple to switch to HTTPS (and if they have OCSP on the server cert for that, that should go via HTTP to avoid loops or further issues).

But what Apple did here is just standard practice, it's just that there happen to be good reasons to diverge from the standard here.

Re: Does Apple really log every app you run? A technical look

#248

Post by Bondi_Blue »

ravenstine wrote: post #5

> macOS does actually send out some opaque information about the developer certificate of those apps, and that’s quite an important difference on a privacy perspective. Yes, and no. If you're using software that the state deems to be subversive or "dangerous", a developer certificate would make the nature of the software you are running pretty clear. They don't have to know exactly which program you're running, but j…

Besides blocking from the hosts file, you can try:

    sudo defaults write /Library/Preferences/com.apple.security.revocation.plist OCSPStyle None
    
    sudo defaults write com.apple.security.revocation.plist OCSPStyle None

Re: Does Apple really log every app you run? A technical look

#250

Post by danShumway »

martimarkov wrote: post #241
danShumway wrote: post #224

Earlier quoted context omitted.

> I don’t see how you can so confidently reach that conclusion. I'm not going to 100% say that control is the reason Apple is doing this. I'm sure that they do genuinely want a way to quickly quash malware, worms, etc... But we've also seen that Apple is clearly willing to use security features to ban developers that stand against them, so I don't understand how people can be so confident that they wouldn't be willin…

Can you remind me of which developers have been banned for standing against Apple AND haven’t broken their contract with Apple?

Security features should not be used for contract enforcement.

My point stands, Apple introduced a security feature then used it for contract enforcement against a company that opposed them. There is no reason to believe that they wouldn't do the same thing here. Whether or not you believe that Epic was the villain in that story is irrelevant to the current conversation.

Post reply on HN