Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Does Apple really log every app you run? A technical look

blog.jacopo.io

Post reply on HN
Print view View original

251–260 of 355 posts

Re: Does Apple really log every app you run? A technical look

#251

Post by danShumway »

tshaddox wrote: post #239
danShumway wrote: post #222

Earlier quoted context omitted.

A couple of problems: - This give Apple access to data right now. If they turn evil in the future, they have access to data from the past, which gives them more leverage. - The security industry (overall) pays attention to Apple updates. If Apple turned evil in the future by issuing an OS update, someone might notice it happening. But if they start organizing this data and handing it off to the government, they don't…

It seems like several people are assuming that Apple is storing the data now and that it is personally identifiable. My assumption was that, of course they would not do that. But of course I could be wrong.

I think the bigger point here is, if Apple started to store the data and make it personally identifiable, you would have no way of knowing that they had.

They wouldn't need to install anything new on your computer to start tracking you in more detail or building a user profile on you, they could just start doing it invisibly behind the scenes on a server someplace. That's a big deal, because even though you're trusting them to administer your device, if they did start pushing out spyware, there's a good chance a security researcher would notice it. But there's no way for us to know what Apple does with this data once it leaves our devices.

Re: Does Apple really log every app you run? A technical look

#252

Post by fsflover »

cute_boi wrote: post #25
josephcsible wrote: post #10

Earlier quoted context omitted.

> I never asked them to do that in the first place, so I'll be blocking it from now on. Apple's working on making sure you can't block it. They already keep you from blocking their own traffic with Little Snitch and similar tools: https://news.ycombinator.com/item?id=24838816

if they keep doing like this I will block their entire ASN .

Do you think you are going to win the war against "your own" hardware?

Re: Does Apple really log every app you run? A technical look

#253

Post by Thomaschaaf »

omk wrote: post #249

If this is just a matter of revoked certificates, Apple could very easily setup a subscription for developer certificates on the machine when an app is installed. Why wait to check if a certificate is revoked once an app is launched?

Because it allows to revoke certificates at a later time. E.g. epicgames certificate was revocable after they noticed that they built in something that was not supposed to be allowed.

Re: Does Apple really log every app you run? A technical look

#254

Post by e_proxus »

andai wrote: post #196
xvector wrote: post #159

Earlier quoted context omitted.

Developer certificate IDs are almost a 1:1 match with which app you’re running.

To use one of the original examples, how many different applications are signed with the developer key of the Tor browser project?

I don’t know the answer to that, but I would assume they are all Tor related so that tells me everything I need to know about a user anyway.

Re: Does Apple really log every app you run? A technical look

#255

Post by fsflover »

whiddershins wrote: post #246
heavyset_go wrote: post #154

Earlier quoted context omitted.

Apple has programmed macOS to make it appear to users as if un-Notarized apps either don't work or are malicious. This is bad for users that download apps to solve problems, or to get work done, because then they can't those apps without having an expert tell them what the magic ritual to run un-Notarized apps is. If they don't have an expert around to show them how to perform the magic ritual, then they just think t…

I dunno. If you can’t confidently change a system preference back and forth, maybe you are very vulnerable to being hacked in general? So maybe it’s ok for Apple’s defaults, at least, to be restrictive? I just want a preference that allows me to turn all of this off.

Extensively discussed here: https://news.ycombinator.com/item?id=24217116.

Tl;dr: no.

Re: Does Apple really log every app you run? A technical look

#256

Post by izacus »

When it comes to these article, you should really apply the following "smell" test:

Replace "Apple" with "Google", "Facebook", "Verizon". Re-read the article. If it sounds horrifying, then it's also horrifying if Apple does it. There's no such thing as "trust" into a single corporation - especially the one which just argued that you not paying 30% to them is "theft".

Applying this test helps weed out the marketing bias these corpos constantly try to push at you.

Re: Does Apple really log every app you run? A technical look

#257

Post by tsimionescu »

sebastien_b wrote: post #186
boogies wrote: post #171

Earlier quoted context omitted.

IMO especially when stock holders wanting a monetary return on investment are involved. I give my money to the FSF every month, because they provide value to me, but not because I expect them to surreptitiously extract it from others and give it to me as cash dividends.

I think that's one of the big problems with public companies, especially those that have "regular people" as their main money maker (the "consumers") - invariably, the company's needs (duty) to make money for their real customers (the shareholders) will take precedence over what would be "the best thing" for consumers. I wish we could do away with the whole "public company" thing - just imagine how much better Facebo…

Privately owned companies are not accountable to their users, they are accountable to their owners, just like publically traded ones. It's just that they have fewer owners, and you sometimes get owners with really nice ideas. Other times, you get even more tyrannical owners.

Instead, what would be really nice is imagining how those companies would fare as worker-owned companies. Especially with these big internet behemoths, where the entire families of all the workers are users, the standard of user care would easily sky-rocket.

Re: Does Apple really log every app you run? A technical look

#258

Post by theginger »

_qulr wrote: post #59
the_duke wrote: post #11

While other posts on this topic are too alarmist, this one is way too Apple apologetic for my taste. * There is no information on how often the validation happens. All this investigation concludes is that it doesn't happen when closing and immediately re-opening an app. Is it every week? Every reboot? Every hour? If it's less, that's essentially the same as doing it on every launch. * There is no justification for se…

> There is no information on how often the validation happens. I wrote a blog post about this. My analysis indicates that Developer ID OCSP responses were previously cached for 5 minutes, but Apple changed it to half a day after Thursday's outage, probably to reduce traffic: https://lapcatsoftware.com/articles/ocsp.html

Any idea how they changed the cache time remotely? If the OS is honouring the cache control headers of a plain text response this has its own security implications.

Re: Does Apple really log every app you run? A technical look

#259

Post by hawski »

_9hey wrote: post #127

Apple has always been a gated community, but now there’s a guard at the gate checking everything that goes in and out. This is something most users probably don’t want. It has me personally considering what a future without Apple would look like.

The guard is also shouting brand names of things you carry in your bag.

Re: Does Apple really log every app you run? A technical look

#260

Post by e_proxus »

tialaramex wrote: post #221
catlifeonmars wrote: post #100

Earlier quoted context omitted.

Or something akin to OCSP stapling, which has been mentioned in a few places?

Stapling makes sense for the Web but not here. With OCSP Stapling the remote web server whose identity you want to assure yourself of periodically gets an up-to-date OCSP answer about its own certificate. When you connect to that server, it gives you the certificate, and the OCSP answer, which assures you that the certificate is still good, and is signed by the Issuer of the certificate. So, you visit Porn Hub, Porn…

Wouldn’t a properly diffed CRL list be much smaller than a hash payload on every app launch? Say, a request like “give me all the revoked certificates since I last asked.”
Post reply on HN