The fact that this was included in the OS without raising alarms is quite revealing in terms of privacy concerns.
Question, is there a good justification to use not use hierachical certificates like web browsers or other OSes ?
Does Apple really log every app you run? A technical look
271–280 of 355 posts
Re: Does Apple really log every app you run? A technical look
#272Earlier quoted context omitted.
I've noticed you have a very apple apologetic stance about this issue and are very active in replying to these articles, far more than the typical HN user. It's gotten to the point where I've noticed your username now. Why is that?
You'd be more aligned with HN values by refuting parent's point with examples than making ad hom attacks.
It is nevertheless the case that some users are VERY LOUD on particular topics, essentially repeating themselves on many leafs of the discussion. I find this very tiresome. It isn't an ad hom to point this out.
Re: Does Apple really log every app you run? A technical look
#273Earlier quoted context omitted.
Isn’t OCSP an open standard for handling certificate revocations? The standard specifies plaintext, because the standard can’t assume that the client has a way to form an encrypted connection to the revocation list.
The standard does not specify plaintext. It says the client may use encryption. Even doing unauthenticated TLS is better than what they do now, because the current situation allows for full passive monitoring.
The problem with 'may' is that a network intermediary might block TLS connections to ocsp.apple.com knowing it would fall back to plaintext.
Apple could encrypt the payload though, using the Apple public key, which would solve the snooping by intermediaries problem.
Re: Does Apple really log every app you run? A technical look
#274Can someone explain my why is this significantly less problematic than sending out app hashes? If we accept that most developers don't have many similarly popular apps, then isn't this enough to infer what apps are users running? In the example from the article: if Mozilla's certificate is sent, then it's very likely that the app that has been opened is Firefox, as the a priori likelihood of using Firefox is way high…
It’s not.
Re: Does Apple really log every app you run? A technical look
#275Earlier quoted context omitted.
Most browsers are stopping ocsp because of the privacy use and the triviality to block it. Did Chrome ever do it? That’s why CT came around. Some background for those unfamiliar. https://scotthelme.co.uk/revocation-is-broken/
Chrome uses its own CRL, which pulls from OCSP https://medium.com/@alexeysamoshkin/how-ssl-certificate-revo... Although OCSP stapling is used more now IIRC.
Chrome uses CRLset, which generates a cut down CRL when the browser is updated, I don’t see any interaction with OCSP
HN doesn’t set OCSP must staple so we’re still a while away from being able to trust it.
Re: Does Apple really log every app you run? A technical look
#276There will be a day when all apps on a mac will only be installable from the app store. Developers will be forced to buy macs and subscribe to Apple’s developer program to support it. Customers will be trained to not care. And HN Apple fanboys and fangirls will try to justify why this is a Good Thing(TM).
We’ve been hearing that for years, yet it hasn’t happened. Apple seems to recognize the value of the Mac as an general computing platform.
Something like that would be happening very gradually over time.
Re: Does Apple really log every app you run? A technical look
#277in my opinion, this seems like Apple, once a computer company that catered to computer users and the expectations of computer users, is now a mobile phone company catering to and responsive to the lower expectations of phone users. to engineer these plain text surveillance communications over the public internet between a users private computer and the company responsible for building that computer is like if my home informed the company that built my home every time I started any unique activity while inhabiting said home, as long as I hadn’t been engaged in that activity for some amount of time. It’s extremely disrespectful to Apples users, who are also Apples customers, who are also mostly all of us on this message board. My goal is to one day grow a backbone and stop putting up with this.
Re: Does Apple really log every app you run? A technical look
#278Good write-up.
I write a lot of Go on my Mac at home. The first run is _always_ slow, but I've never measured it or bothered to find out why. This is a real "lightbulb moment" for me.
I just built a Go executable and timed it: 0.194 for the first, and ~0.018 for subsequent. I haven't signed code on Mac platforms before, so I figured I'd give it a go using the Apple code signing guide [0]. So, I created a self-signed certificate using Keychain, changed and built a Go project, signed the executable [1], and ran it: ~0.400 for the first run, and ~0.018 for subsequent. It... doubled? Will this happen on every first run still? Is there a way to exclude executables?
[0] https://developer.apple.com/library/archive/documentation/Se...
[1] codesign -s
Re: Does Apple really log every app you run? A technical look
#279Earlier quoted context omitted.
Zoom isn't malware, Apple did not revoke Zoom's Developer ID certificate, and indeed Zoom still exists on the Mac. Zoom had a serious uninstaller bug, but that's all it was, and it's not relevant to the current discussion.
Incorrect - zoom exposed a serious vulnerability, and Apple shut it down, using another mechanism but nonetheless the same effect. It’s relevant because you argue that there is no value to having the ability to do this. It is also a problem which occurred every time the app was launched. Something you have dismissed as a non problem. https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-s...
> using another mechanism
> It’s relevant because you argue that there is no value to having the ability to do this.
No, I did not. We haven't talked about that other mechanism, so I've said nothing about it here either positively or negatively.
> Something you have dismissed as a non problem.
I said "Zoom had a serious uninstaller bug". So no, I did not dismiss it as a non problem. It just has nothing to do with Developer ID certificate OCSP.
Please stop putting words in my mouth or completely warping the words that I do say.
Re: Does Apple really log every app you run? A technical look
#280Earlier quoted context omitted.
> There is no information on how often the validation happens. I wrote a blog post about this. My analysis indicates that Developer ID OCSP responses were previously cached for 5 minutes, but Apple changed it to half a day after Thursday's outage, probably to reduce traffic: https://lapcatsoftware.com/articles/ocsp.html
Any idea how they changed the cache time remotely? If the OS is honouring the cache control headers of a plain text response this has its own security implications.
The OCSP response has a nextUpdate field: https://www.ietf.org/rfc/rfc2560.txt